Hot answers tagged

24

You're confusing several things. First, pretty much every standard protocol (save for FTP which you should avoid like plague) has only a handful of standard ports. Since these ports are standards, they will not change often and therefore will not need to be updated. Now, some applications will require specific ports to be opened, Typically, that's handled ...


8

If your goal is to stop a virus or an active attacker from exfiltrating company data stored on a PC that can execute arbitrary code on the same client PC, you're hosed. There's a vast number of sites to dump data to that are the same sites your users ALSO need legitimate access too. You simply can't block these. Unless you're willing to block essentially ...


7

How much you invest in knowledge, products and configuration depends on how high your risk is. There is no solution which will offer 100% security but there is a great difference between the security a simple packet filter firewall can offer or which application level gateways can do: Packet filter firewalls can only filter at the packet level (IP, port, ...


7

Stephane is right, it is quite hard to block everything possible. Rather, I would also start with security/risk analysis to identify which data/systems should be protected at which level. And then search for methods to implement desired protection level. If some protection is not possible, or is extremely complicated technically, there could be compensating ...


6

It is pretty completely silly, if we ignore the lowest level of those capable of retrieving your password (e.g. your teenage kid). For anybody else - they are unlikely to ever see your password with their own eyes, since the whole exploit process is typically scripted, if not fully automated. So the whole usage scenario would be moot regardless. And, ...


5

A switch does not map just one MAC address per port. Multiple nodes can connect to a second hub or switch, which will be connected to the first switch on a single port. An eavesdropper listening on that port can potentially listen to the network traffic of all hosts connected to the second network device whose destination is a host on the first switch.


5

Firewalls aren't going to prevent espionage, but there are many other threats that they can help prevent. For example: If you don't want just any workstation within your organization to spew spam onto the Internet, it makes sense to block TCP port 25 outbound, and require them to use your mail server. To guard against DNS-based attacks, you may want to ...


4

Daniel, I definitely understand where you're coming from. Doing outbound traffic filtering seems like such a pain in the backside. And, well, it can be a real pain in the backside, depending on how you do it and what you hope to accomplish. Moreover, users complain to everyone they can whenever things they want to access for legitimate work purposes (and ...


4

The term you are looking for is defense in depth. It's a term that describes security defences structured so to be layered around what you want to protect; this includes not only security of all ISO/OSI layers but also e.g. physical security: server room with locked doors security badges to access the building security guards inside and outside the ...


2

As I understood from your comments, you want to learn web application security. I would recommend reading web application hackers handbook. This book explains many web application vulnerabilities with simple language yet it goes into detail with each one of them. Also it has really useful "hack steps" which explains how to conduct an attack in detail with ...


2

We don't bother except for 137,138,139,445 to block Windows networking. If we had concern over accident for other things that default on we would debate blocking them too (ref: 200_success's answer on SNMP). It's far too late to protect against malice at this point. I've seen many attempts at monitoring HTTP/HTTPS outbound. The HTTPS mass intercept is ...


2

The logical flaw in the scheme is that you need to know the password in order to access the password. This nullifies any valid use for storing the password in the first place. So, it's not so much a paradox as a fallacy. If your real goad is simply to store a password as securely as possible, then your architecture generally makes sense, but replace ...


1

You seem more worried about the technical details more than about the rest. Besides the basic golden firewalls rules, as to block ingress and egress networks, the others have to be properly evaluated. As @Stephane posted, there is a need to identify what to protect when dealing with a firewall policy. It is of utmost importance to identify what will ...


1

A recent thing to add here which probably is relevant to the question is that Landauer's Principle might not actually hold up: http://phys.org/news/2016-07-refutes-famous-physical.html They measured the amount of energy dissipated during the operation of an "OR" gate (that is clearly a logically irreversible gate) and showed that the logic operation ...


1

Although I very much like @thomas-pornin's answer, I think there's a problem with the first assumption that must be called out. Laundauer's Principle only applies to irreversible operations. Contrary to what some may assume, reversible computing is already achievable. The operations are common in quantum computers and homomorphic encryption systems. ...



Only top voted, non community-wiki answers of a minimum length are eligible