Hot answers tagged

6

No, that's simply wrong. Just like with a jail. They're not only built in a manner to keep anyone from escaping, but as well to prevent anyone from breaking in. You always have to think through both ways. Just an example: windows had a vulnerability that allowed arbitrary code-execution injected in JPGs (I think the format was JPG, but I'm not sure. ...


2

It's highly recommended that you work with your network group to determine where to place Scanner Appliances in an enterprise network environment. Some things to consider: place Scanner Appliances as close to target machines as possible, and make sure to monitor and identify any bandwidth restricted segments or weak points in the network infrastructure. ...


1

It's in the list file itself Peer Block works off of IP lists that you download and enable to block IP addresses on the list unless you allow them. This list also contains meta information in a format such as Label:XXX.XXX.XXX. They're really just .txt files generated by communities after they find someone you shouldn't connect too. Taken directly from a ...


1

Generally it is a good idea to disable bot NBNS and LLMNR. This is due to the fact that both protocols perform name resolution through either broadcast (NBNS) or multicast (LLMNR) which is not safe. For an attacker its possible to perform a MitM Attack using spoofed answers. When you have WPAD disabled there is a wider attack surface. WPAD is the Web Proxy ...


1

Probably to prevent NBNS-Spoofing. Anybody can answer NBNS requests and the requesting host will accept any answer. This enables MitM attacks. You're right that DNS provides the same service more securely and unless you have some legacy systems in your network, it should be safe to disable NetBIOS. In the worst case, having NBNS enabled can lead to a domain ...


1

QUIC by itself is no more dangerous than TCP, UDP, HTTP ... . What matters is the content transferred with the protocol. If you use your firewall only as a simple packet filter and don't do any content inspection (i.e. malware, URL filter etc) then it does not matter much if you allow QUIC or not. If instead your firewall is used to analyse HTTP(s) traffic ...


1

Yes, Please do it . It is still better than a network without any firewall. looking at the link, this is a simple network firewall with DHCP, DNS and SNORT. It does not decrypt your SSL traffic because it is not a Proxy. the Main function of this firewall is to protect your LAN from attacks (including some commonly known DDoS attacks as well). as far as I ...



Only top voted, non community-wiki answers of a minimum length are eligible