Tag Info

New answers tagged

13

Those messages get a D- for technical content and accuracy. The most likely explanation is that these packets arrived late and failed the ESTABLISHED,RELATED check because the connection was already closed. Somewhat less likely is that they actually had the CONNECT flag set in the TCP header, and your firewall is either dropping all incoming connections or ...


0

To answer question 1, I don't think either setting is as secure as you ought to be. Option 1 leaves masq turned on for the WAN when it doesn't need to be. Option 2 sets up a default accept rule for the WAN when it doesn't need to be. To answer question 2 and fill in the blanks on question 1: The input/output rule settings in OpenWRT are the default ...


1

Check out these two guides for more info: http://blog.ipredator.se/howto/openwrt/configuring-openvpn-on-openwrt.html http://tokyobreeze.wordpress.com/2015/01/15/install-openvpn-in-a-router-with-4mb-flash/ The basic idea is to create 3 separate zones, use zone forwarding from LAN to VPN, and turn on Masquerading and MSS clamping on the VPN zone. Be sure to ...


2

Your organization is most likely using a man-in-the-middle ssl cert. They have a program or proxy setup to authenticate your certificate as valid then submit another certificate to the website on your behalf. This is common for companies that must rely on pci or hipaa compliance. Unfortunately, when this is done then your passwords are exposed by this ...


0

Most of the Next-Gen FW use their own Web reputation/AV. I'm sorry but there is still a huge gap between their Global Intelligence Network and a gartner market leader proxy like Blue Coat. Proxies also act has a second layer of defense and they can also be used in reverse proxy mode to protect servers. The level of granularity for policies in a real Proxy is ...


5

There are lots of information about this topic on the internet and on this site, so it does not make sense to repeat everything: a short introduction on how this works you'll find at http://www.zdnet.com/article/how-the-nsa-and-your-boss-can-intercept-and-break-ssl/ and a discussion of the associated problems at What security risks are posed by software ...


15

From reading the disclosure, it seems what happens is that the open port isn't actually just a random port, but rather it is a port where a certain internal service that had never been designed to be exposed directly to the external world was listening on. If there is a vulnerability in that internal service, that might have allowed a possible attacker to ...


0

I create manual scripts to test intended and unintended rules. It requires access to the firewall rules, as well as the intent (comments, tickets) of each. Each firewall rule gets a specific test in the same way a programmer creates unit tests (Test-Driven Development approach). In addition, corner cases are conceived and tested. I generate test traffic ...


2

I usually look firstly at the network diagrams and how the network is or should be configured. This will give me an idea of where is the perimeter, the internal networks, the functional segments and so on. I then look at what are the devices - brand, model - used to manage the environment, whether they are enterprise class and have functionality to unify the ...


2

According to the man page, firewalk looks to need the following flags in order to properly scan when you are one hop from your gateway (as seen in your pretty Gliffy picture). firewalk -d 49152 -r 192.168.1.2 192.168.3.11


3

It is not "secret", but it is "tamperproof". That may not meet your definition of "secure". Your data is no longer confidential if only AH is used - anyone capturing packets can read your data because it is not encrypted. It is protected against modification, however; AH ensures that data tampering will be detected and discarded. AH does not "inherently ...


0

As long as you trust people / computers accessing your network, your printer isn't a big problem. The main security hole is the HTTP-only access, which means that when you manage the printer using it, someone 'may' grab your credentials. And then ? This could only be achieved while you're managing it through the WiFi, not while connected on your ethernet ...


1

Q1: As far as you only block the panel ports (you are not filtering the ssh port by error, for instance). As far as you still can ssh in, and don't forget how to and reenable the panel, it shouldn't lock you out of the panel. Q2 & Q3: You are reducing the exposure surface, so yes you will improve your security. If everything works as it should, you ...


1

Whereas Jari's answer correctly states measures against some MITM attacks, ARP spoofing is a specific MITM attack which is not prevented by enabling DHCP snooping or port-security, (which protect against DHCP race and CAM table attacks respectively). ARP spoofing in particular can be protected against by setting static ARP values deploying dynamic ARP ...


0

ARP spoofing is a layer 2 attack so harden your network by enabling features like DHCP Snooping and port-security on your switches.



Top 50 recent answers are included