Tag Info

Hot answers tagged

33

It's like, "Put the jewelry box outside the house so that robbers won't bother getting in for the TV?" Yes, it is exactly like that. If you don't care about the value of the database, relatively speaking, then sure it makes sense to leave it outside - if the assumption is that the application is horridly insecure, but you need to put it up anyway ...


23

SANS' "Making Your Network Safe for Databases" (http://www.sans.org/reading-room/whitepapers/application/making-network-safe-databases-24) reads a little dated in some sections, but provides a decent "for dummies" level of guidance in the direction you're after. You could also exhaust yourself poking through the US NIST's resource centre ...


14

If the database holds card details, it can be very easily argued that you aren't fulfilling the PCI DSS requirement on appropriate protection. It also fails the sanity checks on single points of failure, and protecting your core assets. If the data is worth billions, why would you not spend a few thousand more to add layers of protection? Industry good ...


9

If you are suggesting that the database server gets moved from being in the same security zone as the web server to being in the same security zone as some internal systems, then one could reasonably conclude that you are reducing security. If status quo is that web server and database server are both in the DMZ, and no connections are permitted from DMZ to ...


5

AvID has already covered the main question, but coming at this from a slightly different angle most firewalls will support multiple interfaces and can provide control of traffic between the interfaces. Configuring the multiple interfaces to host each of the aspects of the solution (frontend, middleware, backend) would reduce the risk of onward compromise of ...


4

Assuming you are attempting to persuade them to do it rather than (necessarily) convince them it is correct: Explain that when their large customers and prospects come to do a security audit they will fail. If the obstacle is the business then that will be the only sufficient, and only necessary, reason.


2

In short, you will have to use a packet sniffer in order to detect traffic that is not destined for your computer. This requires that your network interface be set in 'monitor' mode in order to take advantage of the way networks route packets. Not all wireless cards can do this, you will have to see if yours is compatible. Two examples of network sniffers ...


2

Unsure of what you're asking so I will answer based on what I do understand: if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. This makes little sense. If there is a port scan on the same NETWORK and it does not reach the firewall, it is not detectable by anything? Consider the ...


1

You don't necessarily need two separate firewalls to accomplish this. Without seeing a diagram of your current network topology though, it's difficult to make recommendations. You mention two separate LANS. Are these logically or physically separated? You mention copying files onto a USB drive and moving the data to a machine on the other network. That ...


1

So what you're kind of describing is a DMZ or demilitarized zone. This is a common and widely accepted way for hosting quite a few different services. Such as Web Servers, Mail servers, FTP servers in a safe way. Essentially for your particular use case and from what you've suggested perhaps using a Dual Firewall architecture DMZ with an FTP server in it, ...


1

"ICMPTX" is a very, very minor risk in most real-world situations. It's basically a way for two cooperating programs to sneak data past a firewall that's only looking for data exfiltration over traditional protocols (TCP, UDP, etc.). Unless your AWS VPC is infested with malware and your firewall is inspecting packets for attempted data exfiltration, I ...


1

Very much depends on the signature that is used to match the Heartbleed attack. Unfortunately, most do generate false positives. I have customers with Fortigates, where they have used the rule with a 5-minute quarantine action. Results were pretty bad, they practically DoS-ed hundreds of legitimate customers. But there's a difference between quarantine and a ...


1

For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x subnet that are bound for port 80. -A INPUT -p tcp -s 192.168.1.0/24 -m tcp --dport 80 -j ACCEPT For output, the rules look similar. Therefore, outgoing(egress) ...


1

SonicWall is a company, now owned by Dell, that makes security appliances. http://en.wikipedia.org/wiki/SonicWall I am fairly certain you can find the specifics for any device you own on Dell's website or at sonicwall.com.


1

I believe you have some terminology mistakes in your question, but I still think I can answer it. To answer your question I'll explain both common types of firewalls, stateful and stateless. Both types of firewalls compare packets against their rulesets. Both work from a set of data often referred as a tuple, which typically includes Source IP, Destination ...


1

This sounds suspiciously like a homework question, but I'll answer anyway..... Do firewall rules have to be symmetric? No. That is, does a firewall have to block a particular traffic type both inbound (to the protected site) and outbound (from the site)? No. Why or why not? I've somewhat answered that question here: Firewall & TCP ...


1

Q: Do firewall rules have to be symmetric? Short and simple answer: No, they don't HAVE to be. But it doesn't mean that they CAN'T be. Why? It depends on the traffic that is expected to pass through the firewall, but most of the time the rules won't be symmetric. For example, if you don't have a DNS server inside your network, you will probably block ...


1

The meaning of the word symmetric is in your question, inbound and outbound rule for the traffic. As for blocking the traffic part, actually it is the other way around. All traffic is blocked by default and particular traffic needs to be allowed. If I answer the part related to allowing the traffic symmetrically, then the answer would be yes for stateless ...


1

@Craig...good practical sensible answer. Since bruce_bana said that cost shouldn't be an issue than this should be realistic to implement after using @DerekM answer (which is also good) to convince the alleged security experts. @DTK...good business CYA answer. This one I would definitely implement If i was bruce_bana. @bruce bana...try this link from this ...


1

One good argument is that the bar really isn't that high to separate the web servers and database servers into separate DMZ's. Use a real router/firewall, and put the web servers and database servers on separate VLANs, both of them outside the internal secure LAN, with firewall rules controlling access to the bare minimum required ports from the Internet to ...



Only top voted, non community-wiki answers of a minimum length are eligible