Timeline for A destructive force can always leak information through HTTP packets. Should I bother configuring outbound rules on my firewall?
Current License: CC BY-SA 3.0
22 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 7, 2016 at 10:34 | comment | added | Rui F Ribeiro | Daniel, there are additional technologies, however it is often a cat&mouse game. Helpers/WAFs/Application layer firewalls/DPI/Cisco inspectors, netflows, IDS, baseline of traffic activity. Take all them with a grain of salt. Better to have them than to be flying with a blindfold. I have written a post too, more about what to worry, may expand a bit on it about those more technical details. | |
| Jan 6, 2016 at 21:33 | answer | added | Rui F Ribeiro | timeline score: 1 | |
| Jan 5, 2016 at 18:48 | comment | added | T.Rob | Daniel In addition to attempting to prevent or limit leakage, data egress controls can help detect a leak, aid in forensic analysis, help with post-breach recovery, and reduce liability. The question for any given set of controls is whether they provide more benefit than they cost. Knowing that means understanding the benefits and costs of the controls, having well-defined objectives and evaluating all of that against a threat model using a framework such as @Stephane describes. You are asking the right questions but if you are still able to sleep peacefully you haven't asked enough. | |
| Jan 5, 2016 at 18:09 | comment | added | David Richerby | You might want to edit your first sentence. I assume you mean "I know how to use/configure firewalls" but it can also be read as "I know how to circumvent firewalls." | |
| Jan 5, 2016 at 16:42 | comment | added | Daniel | @T.Rob you misunderstood my position. I am just curious if the approach of blocking outbound ports, as I learned it, was not just something I do because someone told me to. :) | |
| Jan 5, 2016 at 14:27 | comment | added | T.Rob | kubanczyk it's a business case. I work for banks, military, healthcare, insurers, government, etc. and for many of my clients unrestricted outbound access is not an option. Others weigh cost/risk to decide. Still others (far too many) don't bother. However, none of my clients ever started from the position OP and some responders seem to take here that once you accept that you can't stop all attacks then don't bother even trying. At least Stephane describes a process to evaluate the requirements and @halfinformed describes it as a business case. Both are better than "don't bother" IMO. | |
| Jan 5, 2016 at 13:31 | comment | added | kubanczyk | @T.Rob I wouldn't bother. You will drive users mad, drop productivity and still be rather leaky. The most problematic leaking is via crafted DNS queries to a hostile server. But there are just so many other ways... | |
| Jan 5, 2016 at 9:29 | answer | added | mostlyinformed | timeline score: 4 | |
| Jan 5, 2016 at 4:37 | comment | added | Criticizing Israel not allowed | A blacklist (with the default action "allow") will not prevent a determined adversary from leaking data - for that you need a whitelist (with the default action "deny"). A blacklist may help to prevent your own employees from accidentally leaking data, however, so it's not entirely useless. | |
| Jan 5, 2016 at 2:49 | answer | added | Joshua | timeline score: 2 | |
| Jan 5, 2016 at 1:07 | comment | added | Lie Ryan | If you can't trust the people inside your network, you've got an HR problem, either hire better staffs or train them so they wouldn't be easy target for viruses or social engineering. Technical measures can't solve social issues. | |
| Jan 5, 2016 at 0:21 | answer | added | 200_success | timeline score: 5 | |
| Jan 4, 2016 at 20:54 | answer | added | Steve Sether | timeline score: 8 | |
| Jan 4, 2016 at 20:03 | comment | added | T.Rob | "A destructive force can always leak information through HTTP packets." I reject the premise. Many shops operate a whitelist of trusted external sites for outbound user access. For servers they typically implement a Deny-All policy for all outbound traffic and whitelist things like the OCSP URL at their CA. When HTTP(s) is broadly blocked, a bad actor would need to first compromise one of the trusted sites (or the CA) to leak info over HTTP(s) and that's not a "can always" situation. Better title might be "If I deliberately allow unrestricted outbound HTTP and no DPI is it game over?" | |
| Jan 4, 2016 at 19:59 | comment | added | Dan Is Fiddling By Firelight | An attacker with a battering ram can always break my door down. Should I bother closing it when I leave my home? While basic security measures won't stop the most sophisticated attacks, attacks going after the weakest common denominator are far more common than being targeted by a hostile govt intelligence agency/etc; just as most thefts are crimes of convenience not all out attacks on your home. | |
| Jan 4, 2016 at 19:12 | comment | added | OrangeDog | If web access is proxied then external port 80/443 should be blocked for everything except the proxy server. How else would you enforce use of the proxy? | |
| Jan 4, 2016 at 16:17 | history | tweeted | twitter.com/StackSecurity/status/684045988839972865 | ||
| Jan 4, 2016 at 12:42 | answer | added | Steffen Ullrich | timeline score: 7 | |
| Jan 4, 2016 at 11:26 | answer | added | Andrey Sapegin | timeline score: 6 | |
| Jan 4, 2016 at 10:50 | answer | added | Stephane | timeline score: 23 | |
| Jan 4, 2016 at 10:02 | review | First posts | |||
| Jan 4, 2016 at 10:35 | |||||
| Jan 4, 2016 at 10:00 | history | asked | Daniel | CC BY-SA 3.0 |