Article

2011-06-19 Science & Technology

Archived material is restricted to Rantburg regulars and members. If you need access email fred.pruitt=at=gmail.com with your nick to be added to the members list. There is no charge to join Rantburg as a member.

Posted by Uncle Phester 2011-06-19 17:26|| || Front Page|| [4 views ] Top

#1 Trying to standardize things is actually pretty bad from a security standpoint. You want different groups to use different policies and you want them to have different equipment, too. An attack that works against Cisco, might not work against Brocade or Force 10, or Extreme. Same with the operating systems of the servers involved. You want a mix of different operating systems so that they don't all share the same fate when they find themselves under attack.

Consolidation sounds like a great idea to a control freak who wants to make sure everything is just so, but the best security is for things to be quite separate little security domains using different policies and different equipment. An attack that works against one "box" then might not work at all against the rest of the network.

If you have a consolidated policy, a successful attack in one location works just as well through the entire network and you find the entire network compromised.

Heck, it is currently possible to set up a communications channel completely undetected by firewalls using various options and extension headers of IPv6.

There is no such thing as a "secure" network that is connected to the Internet or that is connected to anything that is connected to the Internet. Air gap is the only real security. Anything else is just wishful thinking.

Posted by crosspatch 2011-06-19 20:25|| 2011-06-19 20:25|| Front Page Top

00:14 JosephMendiola
23:52 JosephMendiola
23:43 JosephMendiola
23:35 JosephMendiola
23:12 JosephMendiola
22:43 JosephMendiola
22:37 Dale
22:11 phil_b
21:42 Dale
21:38 Iblis
20:59 phil_b
20:53 Rob Crawford
20:43 Sherry
20:25 crosspatch
20:21 Secret Asian Man
20:09 lotp
19:40 Uncle Phester
19:37 Barbara
19:34 Uncle Phester
19:29 Mitch H.
19:12 Mitch H.
19:09 SteveS
19:03 Jan at work
19:02 SteveS