Tag Info

Hot answers tagged

5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


3

Distributed Denial of Service attacks work because they use multiple (sometimes thousands) of hosts sending traffic to your site to overwhelm your resources. This is not something you, as the target, can remedy. Cloud services, like the ones you mentioned, modify and limit the traffic to your site, and to do that, they need access along the path between your ...


2

The difference is in the amount of information you provide to the sender of the packet. says, essentially: "No-one here. Your SYN packet went to nirvana." It provides the least amount of information to the other end. It also slows down attackers because they have to wait for a timeout. says: "Forbidden. There's someone here but they don't want to talk to ...


2

Employing a default DROP rule for all ports except the ones originally intended(for a website these are 80/443) reduces the attack surface of the given stations on the network. It's much more convenient(and cheaper) to drop packets instead of configuring a service so that it is secure with regards to a given policy.


2

CloudFlare works very well. You can learn more about what they actually do to protect your site from this talk: https://www.youtube.com/watch?v=w04ZAXftQ_Y It's not really possible to deal with such attacks on your own. Maybe in the earlier times, when such attacks were not very sophisticated, you could block off some traffic with your firewall, but now ...


2

DPI threats against OpenVPN is pretty hard, unless the attacker somehow grabs the random, freshly generated session keys which is transmitted over an SSL connection. The SSL connection, in turn, is secured using a pre-shared certificate and a secret server certificate. So an attacker would need to compromise the server itself. Usually, said attackers would ...


1

According to a blog post on 'Trusted BSD', a framework which OSX implements, a Mandatory Access Control (MAC) approach might work. The post seems to indicate that the system will require users attempting to access the resource (unprivileged and admin alike), to have certain associated security attributes. With this framework, there may be a way to prevent ...


1

I think the question you are really asking here is if the two devices can be used to provide effective layers of security. Yes they can but the degree of security will depend on the configuration and capabilities of each device. I recently took a SANS course in which the instructor suggested having a router in front of a firewall doing basic packet ...


1

How to diagnose if you are under a brute scan or a targeted attack? If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create ...


1

But it is only about making channels unidirectional. It suggests that security for bidirectional channels has already been solved, but I cannot find more information. It suggests that a bi-directional channel is simply a pair of uni-directional channels. Btw, they hardly "solve" the problem of uni-directional channels, due to the "back channels" ...


1

A web proxy is the part of an Application Layer Firewall which does Content Inspection for connections from client (i.e. browser) to the web server. It resides on the side of the client and its task is to protect the client against malware etc. A Web Application Firewall (WAF) is a different part of an Application Layer Firewall which also does Content ...


1

The only real reason to prevent a network from being routable through a firewall is to make sure it's isolated both from external and internal unauthorized access. It's impossible for someone to hack into a system if there is no physical path for electrons to travel from their position to the target system's position. By unplugging any cables linking the ...



Only top voted, non community-wiki answers of a minimum length are eligible