Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My company uses strict ACLs for the connection between two boxes. What are the benefits of these?

share|improve this question

closed as unclear what you're asking by Adnan, Scott Pack, NULLZ, Xander, scuzzy-delta Oct 15 '13 at 14:30

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

Access Control Lists help you control traffic between two hosts.

The only completely secure host is one where no traffic is allowed (not just an ACL that says deny all, but unplugging the network cable, removing the keyboard, mouse and other input devices, disabling bluetooth and wireless, removing the screen and powering down the computer, before the burying it in concrete etc...

In reality a certain level of risk is accepted, so ACLs are configured to let through the traffic expected to be needed for the business purpose. This channel is a weakness.

As an example, web servers are placed in a DMZ, with firewalls configured to only allow ports 80 and 443 in. These firewalls add some security, but they allow all attacks on ports 80 and 443, by design. So you also need to protect the servers in case of attack that bypasses the firewalls, and segregate accounts on those servers in case an attacker compromises a low level account and tries to escalate to higher privileges...etc etc

In summary - Defence In Depth is needed if you want to gain a reasonable assurance that you are protecting your devices, as any single control can be compromised. Your aim is to make it hard enough to compromise the layers of defence that you spot the attack before it is successful.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.