Tag Info

New answers tagged

1

You don't necessarily need two separate firewalls to accomplish this. Without seeing a diagram of your current network topology though, it's difficult to make recommendations. You mention two separate LANS. Are these logically or physically separated? You mention copying files onto a USB drive and moving the data to a machine on the other network. That ...


1

So what you're kind of describing is a DMZ or demilitarized zone. This is a common and widely accepted way for hosting quite a few different services. Such as Web Servers, Mail servers, FTP servers in a safe way. Essentially for your particular use case and from what you've suggested perhaps using a Dual Firewall architecture DMZ with an FTP server in it, ...


1

"ICMPTX" is a very, very minor risk in most real-world situations. It's basically a way for two cooperating programs to sneak data past a firewall that's only looking for data exfiltration over traditional protocols (TCP, UDP, etc.). Unless your AWS VPC is infested with malware and your firewall is inspecting packets for attempted data exfiltration, I ...


2

In short, you will have to use a packet sniffer in order to detect traffic that is not destined for your computer. This requires that your network interface be set in 'monitor' mode in order to take advantage of the way networks route packets. Not all wireless cards can do this, you will have to see if yours is compatible. Two examples of network sniffers ...


2

Unsure of what you're asking so I will answer based on what I do understand: if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. This makes little sense. If there is a port scan on the same NETWORK and it does not reach the firewall, it is not detectable by anything? Consider the ...


0

This likely isn't as bad as it sounds. If you have your computer plugged directly in to the modem, random port scanning of IP addresses on the internet is extremely common. On my web server, I get about 30 to 100 invalid login attempts a day trying to get on my system. Hackers look for low hanging fruit, so they will scan large swaths of the Internet ...


-1

You can't block the act of port scanning. Anyone can just pick random IP addresses and scan them looking for open ports. The best thing you can do is tune your Firewall/router to CLOSE/Disable any incoming and outgoing ports that are not being used. If there is no reason you need to remotely connect to your computer, then you should disable all incoming ...


1

For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x subnet that are bound for port 80. -A INPUT -p tcp -s 192.168.1.0/24 -m tcp --dport 80 -j ACCEPT For output, the rules look similar. Therefore, outgoing(egress) ...


1

SonicWall is a company, now owned by Dell, that makes security appliances. http://en.wikipedia.org/wiki/SonicWall I am fairly certain you can find the specifics for any device you own on Dell's website or at sonicwall.com.


1

I believe you have some terminology mistakes in your question, but I still think I can answer it. To answer your question I'll explain both common types of firewalls, stateful and stateless. Both types of firewalls compare packets against their rulesets. Both work from a set of data often referred as a tuple, which typically includes Source IP, Destination ...


1

This sounds suspiciously like a homework question, but I'll answer anyway..... Do firewall rules have to be symmetric? No. That is, does a firewall have to block a particular traffic type both inbound (to the protected site) and outbound (from the site)? No. Why or why not? I've somewhat answered that question here: Firewall & TCP ...


1

Q: Do firewall rules have to be symmetric? Short and simple answer: No, they don't HAVE to be. But it doesn't mean that they CAN'T be. Why? It depends on the traffic that is expected to pass through the firewall, but most of the time the rules won't be symmetric. For example, if you don't have a DNS server inside your network, you will probably block ...


1

The meaning of the word symmetric is in your question, inbound and outbound rule for the traffic. As for blocking the traffic part, actually it is the other way around. All traffic is blocked by default and particular traffic needs to be allowed. If I answer the part related to allowing the traffic symmetrically, then the answer would be yes for stateless ...


1

@Craig...good practical sensible answer. Since bruce_bana said that cost shouldn't be an issue than this should be realistic to implement after using @DerekM answer (which is also good) to convince the alleged security experts. @DTK...good business CYA answer. This one I would definitely implement If i was bruce_bana. @bruce bana...try this link from this ...


0

Tell your direct manager that you are not authorized to accept that risk on behalf of the company. Point out that the value of the data in the database is $xxx and that that level of risk acceptance must come from someone authorized to do so, and ask him to champion getting a member of executive management to sign-off on the risk acceptance. To estimate ...


1

One good argument is that the bar really isn't that high to separate the web servers and database servers into separate DMZ's. Use a real router/firewall, and put the web servers and database servers on separate VLANs, both of them outside the internal secure LAN, with firewall rules controlling access to the bare minimum required ports from the Internet to ...


9

If you are suggesting that the database server gets moved from being in the same security zone as the web server to being in the same security zone as some internal systems, then one could reasonably conclude that you are reducing security. If status quo is that web server and database server are both in the DMZ, and no connections are permitted from DMZ to ...


23

SANS' "Making Your Network Safe for Databases" (http://www.sans.org/reading-room/whitepapers/application/making-network-safe-databases-24) reads a little dated in some sections, but provides a decent "for dummies" level of guidance in the direction you're after. You could also exhaust yourself poking through the US NIST's resource centre ...


1

Very much depends on the signature that is used to match the Heartbleed attack. Unfortunately, most do generate false positives. I have customers with Fortigates, where they have used the rule with a 5-minute quarantine action. Results were pretty bad, they practically DoS-ed hundreds of legitimate customers. But there's a difference between quarantine and a ...


4

Assuming you are attempting to persuade them to do it rather than (necessarily) convince them it is correct: Explain that when their large customers and prospects come to do a security audit they will fail. If the obstacle is the business then that will be the only sufficient, and only necessary, reason.


14

If the database holds card details, it can be very easily argued that you aren't fulfilling the PCI DSS requirement on appropriate protection. It also fails the sanity checks on single points of failure, and protecting your core assets. If the data is worth billions, why would you not spend a few thousand more to add layers of protection? Industry good ...


5

AvID has already covered the main question, but coming at this from a slightly different angle most firewalls will support multiple interfaces and can provide control of traffic between the interfaces. Configuring the multiple interfaces to host each of the aspects of the solution (frontend, middleware, backend) would reduce the risk of onward compromise of ...


33

It's like, "Put the jewelry box outside the house so that robbers won't bother getting in for the TV?" Yes, it is exactly like that. If you don't care about the value of the database, relatively speaking, then sure it makes sense to leave it outside - if the assumption is that the application is horridly insecure, but you need to put it up anyway ...


0

Scanning POP3 traffic for viruses is mostly easy, because the mails are transmitted in full. There are free solutions which can traffic (provided that you have a virus scanner which is mostly not free) and most better (deep inspection) firewalls are able to do this. IMAP instead is much harder, because mail clients often don't get the full mail at once but ...


0

For most companies this is not something you want to get for free. Security of your business network should be handled by proper software/hardware these days, given the rise of the hacker regime. Even smaller businesses these days use some type of mail gateway. I would purchase something like Symantec Mail Gateway ( formally brightmail ) to handle the ...


0

Yes its possible. For example Copfilter ( http://www.copfilter.org ) does this. Its possible even with a provider which does mandatory SSL, by simply having the Connection to be terminated at the UTM. Since there is open-source solutions to the problem you are describing, I bet there is similiar "professional" solutions too. You could check BlueCoat for ...



Top 50 recent answers are included