Network Security - securing network infrastructure and connections
10
votes
4answers
621 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
10
votes
6answers
305 views
Should we configure all devices to never request SSL 2.0, and reject it if offered?
In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side?
Is configuring this on a proxy ...
10
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
10
votes
4answers
1k views
How can mini-computers (like Raspberry Pi) be applied to IT security?
It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
10
votes
7answers
1k views
Egress filtering on an office network?
With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
10
votes
3answers
2k views
Can home routers get infected?
I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but ...
10
votes
2answers
3k views
How do Intrusion Detection Systems (IDS) work?
How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?
10
votes
1answer
559 views
Native rsync protocol security
Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials?
I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
10
votes
1answer
2k views
Is WPA2 WiFi protected against ARP poisoning and sniffing?
Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?
10
votes
3answers
409 views
Is a predictable MAC address a risk?
If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
10
votes
1answer
387 views
XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?
In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
10
votes
4answers
536 views
What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?
We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't?
If we exclude ...
10
votes
5answers
325 views
Alternative to VPN
We have a network that is completely closed to the outside world. It needs to be.
Problem is we need to remote into a server on this network once in a blue moon for diagnostics.
We've discussed ways ...
10
votes
3answers
636 views
VPS security best practice
I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it.
I've previously been hosting it off a VM in the house, but I want to ...
10
votes
3answers
431 views
Are there valid reasons for spoofing an address?
This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.
Are there valid reasons to spoof an address?
10
votes
1answer
1k views
What are darknets, and how can they be used to provide security and anonymity in network communication?
One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
10
votes
3answers
271 views
Tools needed to setup a paranoid remote backup server
I'm a system admin with little security experience. I want to schedule the copying of our backups to protect our data in case of fire. The best solution would be to copy the data onto a new ...
10
votes
2answers
427 views
What is a “pre-play” attack?
I understand what a replay attack is, but I keep reading about a pre-play attack. What is it? Is it when someone intercepts an unused message and blocks the sender so they can't finish using it, and ...
9
votes
4answers
813 views
What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?
I don't want this to be subjective, so I'll try to make the requirements as clear as possible.
On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY:
Using the internet ...
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
9
votes
1answer
330 views
Best way to report a foreigner attacker's ip to authorities?
I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?
From your experience what is the ...
9
votes
2answers
1k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
9
votes
2answers
366 views
How does the Copyright Alert System work? Who has implemented it?
Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright.
I'm concerned how this oversight relates to my private traffic, and what laws ...
9
votes
2answers
335 views
A firewall without any extra features
I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years:
I disabled autorun using these tricks;
I ...
8
votes
5answers
1k views
Access to a router's GUI
During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router.
I realise that someone could log on and be annoying to ...
8
votes
2answers
2k views
Can an attacker sniff Mac addresses on a wifi?
If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
8
votes
4answers
1k views
How can an access point spoof me into connecting?
I was reading through the answers of the question "How can I ensure that I connect to the right wireless Access Point?" and was wondering how it is possible for an access point to imitate another wifi ...
8
votes
2answers
285 views
What is secure enough for web applications?
we intend to build a network in a small health center with No Internet Access
it is expected to have 30 terminal machines, all machines will use an electronic medical record web application
we want ...
8
votes
4answers
2k views
Looking for botnet IP address feeds to protect against DDoS
I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
8
votes
4answers
1k views
Is NTP vulnerable to DNS poisoning or spoofing attacks?
Scenario:
Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application)
Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...
8
votes
4answers
355 views
CAM table attack in 2011?
Today's switches are vulnerable to CAM Table attack?
https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
8
votes
5answers
3k views
Automated tools for Cisco IOS config auditing?
Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
8
votes
2answers
200 views
Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)
In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
8
votes
4answers
257 views
What free tools or techniques exist to discover anomalies in network flows?
I have been using FlowMatrix. What do others do on the cheap?
8
votes
1answer
179 views
Are multiple network interface still recommended in a virtualized world?
Before the virtualization era, it was recommended to have several network card on a physical server :
1 for production dedicated network (only application's stream like
http, SQL*NET, ...)
1 for ...
8
votes
2answers
973 views
Bypassing a reverse proxy/NAT
Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running.
Given that many ...
8
votes
1answer
2k views
Is SOCKS secure?
In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
8
votes
1answer
802 views
What's are the advantages of L2TP/IPSEC over plain IPSEC?
As the title says really, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated it's own IP ...
8
votes
1answer
224 views
Is Chinese great firewall white or black list based? [closed]
Is a new website blocked by default in China ?
I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed).
However a friend of a ...
8
votes
2answers
325 views
How to implement secure device identification in a for-pay wifi router to prevent usage fraud?
After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
8
votes
2answers
196 views
Do any DNS registrars support multi factor authentication?
I am looking for a DNS registrar that supports strong multi-factor authentication.
Does any DNS registrar support multi-factor?
Is this a legitimate need?
7
votes
6answers
213 views
Why shouldn't I run other applications on a Firewall?
If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)?
The only opened port to the world (wan ...
7
votes
4answers
1k views
extract from pcap all protocols found
I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark
I think tshark is able to do it, but ...
7
votes
3answers
361 views
Would publishing a network diagram make the network less secure?
I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration.
Does sharing this type of information decrease the security of my network?
...
7
votes
2answers
1k views
Using RSA with 3DES instead of plain 3DES. Does it make sense?
I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
7
votes
7answers
501 views
IP address black list
My website has a black list of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
7
votes
5answers
3k views
How to detect hosts running in virtual machines with nmap?
I have to determine if a given subnet has virtual hosts.
Are there any ideas about what switches to use?
7
votes
1answer
1k views
SFTP, FTPS and SecureFTP differences and security implications
What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
7
votes
7answers
1k views
What security implications are there for allowing outbound SSH traffic?
My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
7
votes
4answers
1k views
Security Services on Edge Router vs. Standard Firewall
If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it?
For instance, Core Switch --> ...
