Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When clients (which are using both Linux and Windows) block all incoming traffic in a network, and the router is also blocking all incoming traffic, are we (almost) 100% secure? Maybe excluding silly stuff, like when the user runs something in his PC that he found online, or got through email from an unknown source. Add to it, keeping the PCs updated.

Would this be an effective security policy for a small company? Could clients within this network attack/hack other clients?

share|improve this question
    
When you block all incoming traffic, you could just as well plug the network cable, because then there is no communication. –  Philipp Mar 9 at 0:27
1  
@Philipp: no, outgoing connections would still be allowed. Incoming traffic is just traffic generated by sources outside a given network, not by a user who is, for example, navigating the web. –  Quora Feans Mar 9 at 3:47
    
When a user navigates the web, there is outgoing traffic in form of HTTP requests answered by incomming traffic with the web content. I think what you actually mean is that you do not want to allow clients to act as servers. –  Philipp Mar 9 at 3:51
1  
@Philipp: that's completely wrong. See security.stackexchange.com/questions/13286/…. Many beginners get confused by the concept of incoming traffic, but yes, it is not "everything entering." –  Quora Feans Mar 9 at 4:56
    
Quora - that question says exactly the same as Philipp. What you mean is block all requests not initiated from inside –  Rory Alsop Aug 6 at 14:52

3 Answers 3

No, actually the users' behavior online is your biggest risk. If it was just running programs downloaded off the Internet or received in email attachments that would be easy, you could educate users or use technical means to prevent the file downloading and the email attachments.

The problem is your users will contract malware just by visiting web sites or just by opening PDF files! And this is much harder to deal with!

share|improve this answer

Firstly, you would be surprised how many TCP/UDP ports are deliberately left open on routers and PCs regardless of most firewall settings; so as to allow basic operating system network services. If you connect outward from your computer, a network interface is enabled - which results in accepting certain unsolicited incoming packets to maintain that network (DHCP, ARP, etc).

Keep in mind that the 'phoning home' behaviour of many modern apps requires you to either block their outgoing traffic or trust the third-party servers of each application. This includes applications that you usually install and keep up-to-date to have a minimum feature-set on a normal computer (office tools, image editors, browsers, etc).

Usually computers within a local area network of a business are trusted with robust but reasonable router and firewall configurations. After all, if you don't your employees you have an entirely separate problem.

So to answer your question - if you want your business computers to talk to each other they will never be 100% secure (no air gap). But basic principles of browsing/email hygiene, routine anti-virus, routine backups, properly configured routers and encryption of important files will cover most high-risk scenarios.

If you do only one thing for security purposes - get a decent backup solution in place that you use. As data theft with untrusted employees is a much harder problem and deserving of an entire book or hiring a specialist.

share|improve this answer

are we (almost) 100% secure? Maybe excluding silly stuff, like when the user runs something in his PC that he found online, or got through email from an unknown source. Add to it, keeping the PCs updated.

Nothing is ever 100% secure. This makes it a difficult question to answer as what is defined as "silly stuff"? What about XSS and CSRF vulnerabilities on websites visited by your clients. If the clients are switched on and connected to the internet and no one uses them they are probably secure - it would be difficult to get an incoming connection to them on their default settings. Trouble is when users start using them they could be doing anything. As soon as anyone uses a client for something useful then that data used becomes a risk.

Would this be an effective security policy for a small company?

It seems like a reasonable step to take. As said, this doesn't cover every risk, but it would isolate each client from external connections and prevent any viruses from propagating locally.

Could clients within this network attack/hack other clients?

Yes if they are directly connected to one another - if there are any ports open they could be vulnerable and potentially be exploited by another client (e.g. if anyone has accidentally clicked Yes to the Windows Firewall prompt for a service listener). There is also the possibility of MITM attacks against other clients on the network. If you want extra security you could configure your network to isolate each client (some routers have this option for the wifi network), but with a wired network this would be more difficult.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.