anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises?
services like:
https://www.iptrust.com/
http://ipremoval.sms.symantec.com/lookup/
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|||||
|
|
In the past I have used OpenDNS for a client. OpenDNS detected that not only was there malware phoning home on the network, but that there was Botnet traffic also coming from the network. The problem was that since OpenDNS sits outside the network, it only sees the public IP of the network--Since there were >150 machines on the internal network, there was no easy way to tell which one was infected. So my caution would be that unless there was a 1 to 1 relationship to the public IP and the computer (webserver or something like that), or the IP rep service sniffed the traffic before it was NATed, then I am not sure how valuable it will be, except as an alerting mechanism that there is something nefarious going on in the internal network. -Josh |
|||
|
