full-disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3FA2E29C.80405@venom600.org>
From: lists at venom600.org (Ben Nelson)
Subject: Proxies

>>only understands HTTP (to prevent other services from being tunneled
>>over port 80), you should be good to go.
> 
> 
> That isn't going to stop other services from being tunneled over port 80.
> There quite a few ways to do this. See Firepass. It is a tunneling tool,
> allowing one to bypass firewall restrictions and encapsulate data flows
> inside legal ones that use HTTP POST requests. TCP or UDP based protocols
> may be tunneled with Firepass

Very true.  Bottom line....there will always be a way.  It's just a 
matter of how sophisticated your clients (K-12 students and teachers in 
this case) are.    If you can narrow the illegal traffic down enough 
that any breaches are an anomoly that is caught by your IDS (or some 
other form of monitoring), then you're doing well.  Once the anomoly 
shows up, you can enforce your policy; which I should mention should 
also be an integral part of the security architecture.  If you can't 
enforce the policy, there's no incentive to follow it.

$.02
--Ben