Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises?

services like:
https://www.iptrust.com/
http://ipremoval.sms.symantec.com/lookup/

share|improve this question
    
Is this really a question, in the StackExchange sense? –  Iszi Jan 10 '11 at 20:48
    
as per @Iszi's comment, do you fancy rewording the Q to be more of a Q? –  Rory Alsop Jan 29 '11 at 11:07
add comment

1 Answer

up vote 2 down vote accepted

In the past I have used OpenDNS for a client. OpenDNS detected that not only was there malware phoning home on the network, but that there was Botnet traffic also coming from the network. The problem was that since OpenDNS sits outside the network, it only sees the public IP of the network--Since there were >150 machines on the internal network, there was no easy way to tell which one was infected.

So my caution would be that unless there was a 1 to 1 relationship to the public IP and the computer (webserver or something like that), or the IP rep service sniffed the traffic before it was NATed, then I am not sure how valuable it will be, except as an alerting mechanism that there is something nefarious going on in the internal network.

-Josh

share|improve this answer
    
I didn't realise OpenDNS offered that sort of info as a service. Cheers. +1 –  Rory Alsop Jan 10 '11 at 12:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.