full-disclosure - Re: January 15 is Personal Firewall Day,help the cause

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: vimages at well.com (Jim Race)
Subject: Re: January 15 is Personal Firewall Day,help
 the cause

Valdis.Kletnieks@...edu wrote:

> What's your threat model?  Does it have to be "safe" against just the random
> crap that is background noise on today's networks, or are there other considerations?

The box happily rejects all the noise. The HW FW logs are skimmed daily, 
but no real alerts are installed. Fully aware a persistent *smart* 
attacker could likely easily DoS it, or perhaps worse. Latest (known 
good) firmware on the FW as well.

> 
> What's your trade-off model?  If it *does* get whacked, what are the
> consequences? Remember to *NOT* spend more time/money/effort on securing it
> than you would lose if it was in fact compromised.

The "time" is something "free" at this point. To be honest my "friend" 
(ahem) is one of those who has installed various flavours of Linux 
several times. Truth be told he (I) would prefer to move the web server 
to a more hardened Linux box but it's "easier" at this point to just 
deal with everything in one place.

> If it's a personal machine, you're just using Apache to serve up photos of the
> barbeque to your friends, and the worst that happens is you have to reload your
> 'My Documents' folder off a CD-ROM backup, you're probably *very* safe. Just
> remember to not piss off a script kiddie on IRC. ;)

I don't use the windows FS like MS might like me to. All the server docs 
  are on a separate drive, backed up weekly or more often as needed. "My 
Documents" contains a few things unintentionally misfiled long ago when 
I was using IE for some random site. Indeed, it's 95% personal stuff. 
"Work stuff" is simple consulting gigs or mirroring for friends.

> 
> If you're using the machine to access a corporate database, you probably want
> to do some more policy-level and ACL hardening on the inside - the biggest
> threat to your HR database is still an underpaid secretary in Accounts
> Receivable.

Nope. No corporate remote access from this box (although a VPN'ed laptop 
with a different OS is occasionally used from the same subnet).

> 
> If you're using the machine in a true life-or-death environment (medical
> monitoring, processing classified data, launch codes, etc), you're nowhere near
> hardened enough.

Only life or death would be loss of connectivity. :) Nowhere near that 
important...

-jim