We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

Filter by
Sorted by
Tagged with
15
votes
3answers
1k views

Are there valid reasons for spoofing an address?

This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?. Are there valid reasons to spoof an address?
17
votes
5answers
4k views

Why don't ISPs filter on source address to prevent spoofing?

I'm under the impression that if all the ISPs were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably. Are any ISPs implementing this ...
1
vote
1answer
262 views

What is your experience with AlertLogic?

Do you have any insight, or experience (good or bad) regarding AlertLogic? In what areas can they improve, what areas are they lagging in?
7
votes
3answers
2k views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a link farm in the average case. Most protocols on assorted, unknown high ports contain little or no plain text, and often if ...
10
votes
5answers
2k views

How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?

I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
25
votes
6answers
6k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
10
votes
2answers
2k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
9
votes
3answers
747 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
7
votes
2answers
1k views

What is your approach to handling Guest Internet access?

Suppose you're a company that uses a web proxy to block objectionable content on your corporate network, and this technology may cause issues with some 3rd party VPNs. Or perhaps this 3rd party is ...
7
votes
4answers
780 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
8
votes
4answers
2k views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
19
votes
1answer
6k views

SFTP, FTPS and SecureFTP differences and security implications

What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
29
votes
7answers
3k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
6
votes
2answers
209 views

Managing a team of IDS experts; how would you organize your team?

Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? .....
3
votes
2answers
182 views

When would you support the storage of Security & Application event logs in the Cloud?

Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises? When would you consider a SaaS /hosted solution and what value add should that ...
7
votes
3answers
554 views

What tools are available for distributing and syncing firewall rule-sets to multiple devices?

I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
13
votes
7answers
4k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
10
votes
6answers
483 views

Should we configure all devices to never request SSL 2.0, and reject it if offered?

In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side? Is configuring this on a proxy ...
2
votes
2answers
7k views

Is it possible to change the admin user/password remotely on a router without logging in? [closed]

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
6
votes
2answers
4k views

What are the security risks of the Service Bus, and how do you mitigate them?

The Service Bus is software that can be installed on Windows or rented on Azure and allows someone to relay SOAP/WCF information over the internet in the form of a XML over HTTPS payload. One risk ...
8
votes
2answers
614 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
21
votes
1answer
13k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
9
votes
2answers
1k views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
10
votes
2answers
3k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
5
votes
1answer
228 views

When should a DNS entry be cached? What conditions should not be? How do I determine the TTL?

I'm writing a DNS resolver and am building a spreadsheet of when a DNS record should be cached, and not be cached... but it's harder than it first looks (to me at least). Is there consolidated test ...
5
votes
2answers
282 views

What risk do International Domain Names (IDN) pose?

I understand that IDN's are basically a GUI display change for domains that have a prefix of "xn--". What should I advise companies do in regards to these domains? For example, should companies ...
12
votes
5answers
2k views

Powerful security tools to use in penetration testing

I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
27
votes
3answers
2k views

What are the security risks in enabling ipv6

We are considering enabling ipv6 on our webservers, so that we are reachable with both ipv4 and ipv6. Are there any security issues we should consider when enabling ipv6?
27
votes
3answers
23k views

What benefits does Nessus have over OpenVAS?

Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users anyways)?...
24
votes
4answers
4k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
9
votes
1answer
5k views

Management Network Best Practices

I am looking at setting up a Management vlan, on which I will put all the Management interfaces for my various networkable devices (Firewall Mgmt Interfaces, Server RAC, WAP Mgmt Interfaces, etc). ...
11
votes
2answers
2k views

Online SQL Server database for a Business app. Security considerations

A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
8
votes
5answers
3k views

Creating tunnel with most ports closed?

How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since ...
11
votes
3answers
2k views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
74
votes
5answers
35k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
12
votes
7answers
2k views

Is an IP address blacklist good practice to prevent website attacks?

My website has a blacklist of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
12
votes
4answers
1k views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...