Network Security - securing network infrastructure and connections
31
votes
6answers
6k views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
22
votes
7answers
7k views
Why do people tell me not to use VLANs for security?
I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
15
votes
5answers
2k views
Security impact of using a public password for free WiFi
We have a WiFi network that we want to be public and free.
Does having a password that is known to everyone provide any additional security advantage to the people using this network as opposed to ...
13
votes
6answers
1k views
What security risks does IP spoofing bring?
By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
11
votes
7answers
9k views
What is the difference in security between a VPN- and a SSL-connection?
I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
7
votes
2answers
447 views
Any advantage to securing WiFi with a PSK, other than to keep out unauthorized
As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key.
In which case, if you are not going to ...
96
votes
8answers
8k views
Are “man in the middle” attacks extremely rare?
In
http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
17
votes
6answers
1k views
Port Knocking is it a good idea?
Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
8
votes
5answers
1k views
Access to a router's GUI
During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router.
I realise that someone could log on and be annoying to ...
21
votes
3answers
2k views
How does Convergence (CA replacement) prevent its notaries from being MITM'd as well?
I have been looking into Convergence and how it works, but I cant figure out how it is effective against a MITM attack that happens near the target system. My understanding is that Convergence works ...
12
votes
3answers
2k views
Nessus vs third-party scans
As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
16
votes
2answers
420 views
In what scenarios is relying on source IP address as a security control acceptable/unacceptable?
I've noticed that there's a number of questions where relying on source IP address as a control gets mentioned and in most gets dismissed as being unreliable.
I'd be interested in hearing from anyone ...
10
votes
2answers
1k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
20
votes
7answers
5k views
Why block outgoing network traffic with a firewall?
In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
7
votes
2answers
4k views
sniffing/recording GSM 3G signals
Is it possible to sniff or record and process GSM 3G signals (from some reciever) given that there is no other signals interrupting etc (the most comfortable conditions)
Update (with some supporting ...
5
votes
7answers
1k views
What security risks exist in cell phone apps' data transfer?
Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
4
votes
2answers
286 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
8
votes
2answers
328 views
How to implement secure device identification in a for-pay wifi router to prevent usage fraud?
After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
5
votes
2answers
2k views
How can someone hack my PC if I am connecting to the internet through NAT?
If I own a private IP address, 192.168.2.1 for the sake of it, and I am physically connected to my router, which it's internal interface is 192.168.2.254 and it's external interface is some public IP ...
5
votes
3answers
3k views
How can I keep a roommate from seeing my web activity?
I have a roommate who is a network security engineer and I think he hacked our home network and now knows what sites I am visiting and what I am doing online. Although he is not stealing anything I ...
2
votes
3answers
188 views
Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?
OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure.
But basically, ...
18
votes
6answers
799 views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
16
votes
7answers
789 views
Securing the security guy's home office: what should we do?
I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
12
votes
5answers
5k views
Security risk of PING?
I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
12
votes
10answers
8k views
Public DMZ network architecture
Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one:
Now that I got employed, my boss, a ...
8
votes
5answers
3k views
Automated tools for Cisco IOS config auditing?
Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
5
votes
2answers
3k views
Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?
We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related ...
24
votes
1answer
969 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
6
votes
2answers
4k views
What is best practice for separation of trusted zones from a DMZ with a single firewall?
At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
6
votes
1answer
456 views
How to get hold of and use WPA session keys?
I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I ...
6
votes
5answers
2k views
Can I block based on Mac Address?
Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ?
I want to block at the Webserver level so that unwanted users ...
5
votes
4answers
835 views
Why don't ISPs filter on source address to prevent spoofing?
I'm under the impression that if all the ISP's were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably.
Are any ISPs implementing this ...
10
votes
3answers
436 views
Are there valid reasons for spoofing an address?
This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.
Are there valid reasons to spoof an address?
8
votes
4answers
363 views
CAM table attack in 2011?
Today's switches are vulnerable to CAM Table attack?
https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
7
votes
1answer
1k views
SFTP, FTPS and SecureFTP differences and security implications
What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
5
votes
2answers
796 views
Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?
I have read the TCP Connection Establishment on Wikipedia
In brief the packets to start are
SYN, with a (hopefully) random sequence number A from the client.
SYN-ACK, responding, with A+1 and ...
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
3
votes
7answers
387 views
Scanning A Subnet Externaly
Scenario:
I have a router with a public IP address provided by the ISP and two hosts behind the router with a private IP (192.168.x.x).
Is it possible to perform a port or vulnerability scan of a ...
10
votes
1answer
2k views
What are darknets, and how can they be used to provide security and anonymity in network communication?
One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
23
votes
3answers
15k views
What is the difference between SSL vs SSH? Which is more secure?
What is the difference between SSH and SSL? Which one is more secure, if you can compare them together?
Which has more potential vulnerabilities?
12
votes
6answers
2k views
Can I detect a MITM attack?
Based on this question here:
Are "man in the middle" attacks extremely rare?
Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it?
In addition, what if ...
13
votes
5answers
1k views
To firewall or not to firewall?
There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
11
votes
2answers
11k views
What is the real function and use of a DMZ on a network?
I read the article on Wikipedia describing what a DMZ (demilitarized zone) is on a network, but am still failing to grasp both how it is set up (ie: is it within the main network or sequestered away?) ...
10
votes
5answers
8k views
How to find out that a NIC is in promiscuous mode on a LAN?
How to find out that a NIC is in promiscuous mode on a LAN?
8
votes
4answers
257 views
What free tools or techniques exist to discover anomalies in network flows?
I have been using FlowMatrix. What do others do on the cheap?
7
votes
5answers
3k views
How to detect hosts running in virtual machines with nmap?
I have to determine if a given subnet has virtual hosts.
Are there any ideas about what switches to use?
13
votes
4answers
696 views
IPsec (Internet Protocol Security) facts
Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
10
votes
8answers
1k views
Can IP address be a component of 2-factor authentication?
I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
10
votes
3answers
642 views
VPS security best practice
I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it.
I've previously been hosting it off a VM in the house, but I want to ...
