Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

8
votes
3answers
3k views

Encryption on mobile phone - myth?

Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
8
votes
3answers
3k views

Risk of configuring MySQL for remote access with a dynamic IP address?

I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
8
votes
4answers
583 views

CAM table attack in 2011?

Today's switches are vulnerable to CAM Table attack? https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
8
votes
4answers
4k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
8
votes
3answers
400 views

Securing a LAN without Physical Security

I've got an interesting dilemma. I have a large (50+ users) office that is going to be on the campus of a local university. The purpose is to foster collaboration, etc, but the open environment is ...
8
votes
1answer
10k views

Are open ports dangerous?

I have forwarded port 80 to WAMPServer and 25565 to the MineCraft-server running Bukkit. (http://www.bukkit.org/) Am I vulnerable to attacks. Can hackers attack me if WAMP-server is running or if it ...
8
votes
1answer
412 views

Is the system bios and network card protected by the OS firewall?

My question arises from trying to understand new types of spyware that target the system bios and/or network card. Is the system bios and ethernet card both protected by an OS firewall set to deny ...
8
votes
2answers
214 views

Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)

In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
8
votes
1answer
225 views

Are multiple network interface still recommended in a virtualized world?

Before the virtualization era, it was recommended to have several network card on a physical server : 1 for production dedicated network (only application's stream like http, SQL*NET, ...) 1 for ...
8
votes
1answer
1k views

Spoofed IPv4 and IPv6 addresses over the internet

I have a few questions regarding IPv4 and IPv6 spoofing. Might as well just list them to be concise: What's the usual routing policy for ISPs' routers in regards to spoofed source addresses? i.e. if ...
8
votes
5answers
1k views

Creating tunnel with most ports closed?

How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since ...
8
votes
2answers
2k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
8
votes
1answer
275 views

What is the security vunerability in this scenario?

I saw this question: Suppose a university with address block 12.1.0.0/16 has a link connected to AT&T, where the AT&T router forwards packets destined to 12.1.0.0/16 to the university ...
8
votes
1answer
346 views

Is Chinese great firewall white or black list based? [closed]

Is a new website blocked by default in China ? I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed). However a friend of a ...
8
votes
1answer
643 views

What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?

What are the main issues and recommended controls when exposing SIP and H.323 to the Internet (could be for voice, video, and instant messaging traffic or all three)? Specifically I'm looking for ...
8
votes
2answers
235 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
8
votes
2answers
459 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
8
votes
3answers
1k views

Secure PXE network OS installation

How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)? Would it be possible to ...
8
votes
3answers
144 views

What are the risks to a network if a single computer is compromised?

If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
8
votes
1answer
507 views

SSH Brute Force Dictionaries

Request for logs please. So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
7
votes
6answers
256 views

Why shouldn't I run other applications on a Firewall?

If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)? The only opened port to the world (wan ...
7
votes
8answers
23k views

How to block some websites and torrent usage in a small office?

In my office there are approaximately 25 systems are connected through network and all having internet accessibility.but some people are missusing this facilities like downloading films from torrent ...
7
votes
4answers
5k views

Is the US military secret network SIPRNet physically or cryptographicaly separated/secured?

I've read the Wikipedia articles on SIPRNet and NIPRNet (which are pretty light on details) and they are supposed to be considered separate. At the network level, are they technologically ...
7
votes
2answers
3k views

Dictionary Attack on Wifi

I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe? ...
7
votes
10answers
609 views

networking and security

I'm trying to pick up networking security within a reasonable amount of time. I'm not specifically looking to learn about all the little tools that are available (although I do want to know about ...
7
votes
4answers
702 views

IP Address spoofing?

According to: https://secure.wikimedia.org/wikipedia/en/wiki/IP_address_spoofing "this technique is mainly used when the attacker does not care about the response or the attacker has some way of ...
7
votes
4answers
3k views

Security Services on Edge Router vs. Standard Firewall

If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it? For instance, Core Switch --> ...
7
votes
2answers
236 views

What to add to a repeating security checklist?

I work in a smallish company (100-200 computers and a handful of servers) and I am trying to come up with a checklist of things to check at a regular basis, such as weekly, monthly, etc. We use ...
7
votes
2answers
1k views

IIS IP Address Restriction - can I rely on it online?

I've been told that I might have more luck posting here than on Stack Exchange, so here goes: I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no ...
7
votes
1answer
466 views

different portscan tools give different results

I have different results as of my open TCP ports. When using nmap -sS 127.0.0.1, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How ...
7
votes
6answers
8k views

How to detect eavesdropping by your ISP

I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss. I know how to get around this online, use a ...
7
votes
3answers
665 views

Is IPv6 with NAT less secure than IPv4?

This is a follow up to a snippet from another answer. There, user Ninefingers writes: (...) only allow outbound connections, ever. Do this in spite of NAT as IPv6 will make those NAT defences ...
7
votes
6answers
2k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
7
votes
2answers
860 views

Any advantage to securing WiFi with a PSK, other than to keep out unauthorized

As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key. In which case, if you are not going to ...
7
votes
3answers
12k views

Detecting(and locating) rogue DHCP server on a local area network

How would we detect and locate a rogue DHCP server on our local area network?
7
votes
2answers
248 views

How serious is a local virus in terms of network security

My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him ...
7
votes
2answers
7k views

How can someone hack my PC if I am connecting to the internet through NAT?

If I own a private IP address, 192.168.2.1 for the sake of it, and I am physically connected to my router, which it's internal interface is 192.168.2.254 and it's external interface is some public IP ...
7
votes
2answers
454 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
7
votes
3answers
1k views

Why don't wifi managers remember mac addresses for hotspots to defeat the jasager attack?

So I just learned about the jasager attack, via the wifi pineapple and it struck me immediately that it wouldn't work at all if network managers (privately) associated MAC addresses with hotspots and ...
7
votes
4answers
1k views

Verify Mac firmware is not hacked…how to do?

I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards. Normally, Little Snitch will report every app that uses the internet. Every ...
7
votes
2answers
283 views

What tools are available for distributing and syncing firewall rule-sets to multiple devices?

I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
7
votes
1answer
176 views

Deanonymizing users by introducing structured delays to the network?

Here is a scheme for deanonymizing a user that I've been thinking about, just out of curiosity. I tried searching for it but didn't find much. Does this technique have a name? Are there any papers or ...
7
votes
1answer
845 views

AWS VPC - should connections between instances be over SSL?

Say I have a few EC2 instances in an AWS VPC network, each assigned its own private address for the subnet at creation. Say one of them is a DB, and another one some kind of web app talking to the DB. ...
7
votes
3answers
2k views

Alternative approaches to using DMZ for securing communication to and from external web server outside firewall

I am a software developer with little network security knowledge and almost no knowledge of the current network architecture for the environment I work in. If I had any, I still would not want to ...
7
votes
3answers
938 views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
7
votes
3answers
3k views

Private Tor networks: what are the benefits, and how would it be accomplished?

What are the benefits of someone building a private Tor network? ...One that is disconnected from the well-known network being used on the Internet at-large. My intent is to make Tor more ...
7
votes
1answer
736 views

How secure is the apt-get install command against man in the middle attacks

I think the title says everything, how secure is it to use apt-get in a network with an attacker who injects his own packets and blocks the original packets (man in the middle).
7
votes
1answer
2k views

Security Operation Center (SOC)

I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
7
votes
1answer
195 views

Trace large volume of web traffic, stopped at VPN

I have a web server. I recently received a large volume of web traffics, after tracking it down, it is coming over a commercial VPN provider. Is there any way to keep the tracing going, beyond the ...
7
votes
3answers
452 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...