Tag Info

New answers tagged

0

One good argument is that the bar really isn't that high to separate the web servers and database servers into separate DMZ's. Use a real router/firewall, and put the web servers and database servers on separate VLANs, both of them outside the internal secure LAN, with firewall rules controlling access to the bare minimum required ports from the Internet to ...


5

If you are suggesting that the database server gets moved from being in the same security zone as the web server to being in the same security zone as some internal systems, then one could reasonably conclude that you are reducing security. If status quo is that web server and database server are both in the DMZ, and no connections are permitted from DMZ to ...


12

SANS' "Making Your Network Safe for Databases" (http://www.sans.org/reading-room/whitepapers/application/making-network-safe-databases-24) reads a little dated in some sections, but provides a decent "for dummies" level of guidance in the direction you're after. You could also exhaust yourself poking through the US NIST's resource centre ...


1

Very much depends on the signature that is used to match the Heartbleed attack. Unfortunately, most do generate false positives. I have customers with Fortigates, where they have used the rule with a 5-minute quarantine action. Results were pretty bad, they practically DoS-ed hundreds of legitimate customers. But there's a difference between quarantine and a ...


4

Assuming you are attempting to persuade them to do it rather than (necessarily) convince them it is correct: Explain that when their large customers and prospects come to do a security audit they will fail. If the obstacle is the business then that will be the only sufficient, and only necessary, reason.


12

If the database holds card details, it can be very easily argued that you aren't fulfilling the PCI DSS requirement on appropriate protection. It also fails the sanity checks on single points of failure, and protecting your core assets. If the data is worth billions, why would you not spend a few thousand more to add layers of protection? Industry good ...


5

AvID has already covered the main question, but coming at this from a slightly different angle most firewalls will support multiple interfaces and can provide control of traffic between the interfaces. Configuring the multiple interfaces to host each of the aspects of the solution (frontend, middleware, backend) would reduce the risk of onward compromise of ...


25

It's like, "Put the jewelry box outside the house so that robbers won't bother getting in for the TV?" Yes, it is exactly like that. If you don't care about the value of the database, relatively speaking, then sure it makes sense to leave it outside - if the assumption is that the application is horridly insecure, but you need to put it up anyway ...


0

Scanning POP3 traffic for viruses is mostly easy, because the mails are transmitted in full. There are free solutions which can traffic (provided that you have a virus scanner which is mostly not free) and most better (deep inspection) firewalls are able to do this. IMAP instead is much harder, because mail clients often don't get the full mail at once but ...


0

For most companies this is not something you want to get for free. Security of your business network should be handled by proper software/hardware these days, given the rise of the hacker regime. Even smaller businesses these days use some type of mail gateway. I would purchase something like Symantec Mail Gateway ( formally brightmail ) to handle the ...


0

Yes its possible. For example Copfilter ( http://www.copfilter.org ) does this. Its possible even with a provider which does mandatory SSL, by simply having the Connection to be terminated at the UTM. Since there is open-source solutions to the problem you are describing, I bet there is similiar "professional" solutions too. You could check BlueCoat for ...


1

It is likely that the port you have open will always show as being in a different state from other ports if someone does a scan of your IP address, so it would make sense to ensure that there definitely isn't anything listening when the game server is shutdown (although if the game has vulnerabilities it probably does not matter if it is listening all the ...


0

On your client: An 'open' port (TCP) will respond to a new connection request - the remote client will send a 'SYN' and your server will reply with a SYN-ACK starting the TCP/IP 3 way handshake. if it's 'closed' then your server will reply with an RST - effectively 'refusing' the connection. What a firewall does is: If a port is 'authorized' then ...


-1

A port isn't open if something isn't listening for a connection on it. I am not sure what type of firewall you are using. Is this a virtual firewall? software? Hardware appliance? The reason it is bad form to have ports open is that it exposes those services that are listening on those ports to exploits. That is why firewalls exist, to limit what is allowed ...


-2

No, it just means your firewall would allow traffic to that port but there would be no response. It shouldn't cause any issue whatsoever.


2

Whether a VPN is necessary in this scenario would largely depend on the nature of the traffic between the worker and the web server and whether you're worried about Man-In-The-Middle(MITM) attacks. A VPN could add two potential benefits to your security here. Firstly it should encrypt the data between the endpoints. This is obviously a security benefit if ...


1

There is NSS Labs which contrary to Gartner actually tests the devices. But, talking about firewalls is just about as specific as taking about means of transport. What you actually need varies between a hand barrow and a container ship. Even within the same class (like passenger car) you will find lots of different solutions which not only differ by price ...


-2

IP Addresses are trivial for an attacker to spoof and should not be considered anything other than a log analysis data point. You should also know that MPLS 'VPNs' are not as secure as a real VPN. Paul Coggin expounded on this at BSides Nashville: http://www.irongeek.com/i.php?page=videos/bsidesnashville2014/300-bending-and-twisting-networks-paul-coggin. ...


3

Separate physical locations can share the same logical network using a VPN. A client's IP address can be used in a multi-factor authentication system, but a password and a Key FOB is more commonly used.


0

I had a very similar setup, and the packet tracer showed that it should work both ways. I was a bit stumped. My issue, and something I should not have overlooked, was providing a route to my DMZ subnet from my Layer 3 device on my LAN. In my setup, we have a core L3 switch that handles our routing. Since the DMZ subnet is not being broadcast, I needed to ...


0

So first lets look at these two. A Web Application Firewalls, as the name implies, work with web applications almost exclusively. Most WAF are often not best-of-breed traditional firewalls, and should not be implemented in place of a traditional network firewall. Typical WAF deployments feature SSL decryption of web application traffic and blocking of ...


8

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other. An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is ...


1

You should give consideration to converting the document from its native format. Convert JPG to PNG, say, and Word to PDF. It's a catch-all attempt to try and remove any document-specific malware. The advantage is that it might protect against unknown and future threats. The disadvantage is that it might mess with formatting or lose content. The level ...


0

As far as setting up SNORT goes, here is a video I found on Youtube that may be helpful (it appears to be difficult to set up): https://www.youtube.com/watch?v=_ic07nBoweg It appears you would want to at least practice good computer security to make being hacked more difficult. As far as tracking packages, I am not aware of what the best solution is, but ...


0

I think there is no technical solution which reliable works in this environment. The use of an unsecured WLAN indicates a lack of understanding of security in this school. I would not trust them to handle a system with known security problems in a secure way. Instead you risk with your offer, that they will point at you once the system not only got infected ...


2

Given the limited scope of use, I would say no, anti-virus is not critical. There are a couple of things I would do here to ensure that it's as secure as it can be, under the circumstances. Make sure you have all the latest Windows Updates for XP. (May they rest in peace.) Ditch Norton entirely, and configure the Windows firewall to reject all inbound ...


0

Of course, ideally every Windows computer should have antivirus. However, if the only website this computer will be visiting is Gmail, then I think the chances it will get infected are pretty low as long as whoever is using it knows some basic computer safety tips (like not clicking random ads or opening unfamiliar emails & attachments.) Thus it may be ...


0

This situation really depends on how you want to approach this issue, Yes you will always need virus protection, I wouldn't recommended Norton as the best solution for this. It has its pro's but its a complete resource hog and will contribute in taking large amounts of Resources. Better to find something with a smaller footprint like Microsoft security ...


1

You probably won't find it for desktop firewalls. That feature requires a much higher level of network knowledge than most users have/are willing to study. Therefore, firewall companies won't put much effort developing something like this. On the other hand, professional network appliances tend to be more inclined in that direction. I know that the Palo ...


1

I vote for option # 1, and I have first hand experience with this. I'm seeing a lot of misinformation and/or bad advice in some of these comments and answers. The scanner should: have admin level access to the assets. have access to assets on all ports/protocols. be whitelisted on IPS/IDS sensors and other security devices. The main purpose of a ...



Top 50 recent answers are included