[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <40098EB0.7070701@well.com>
From: caferace at well.com (Jim Race)
Subject: Re: January 15 is Personal Firewall Day,help
the cause
Valdis.Kletnieks@...edu wrote:
> What's your threat model? Does it have to be "safe" against just the
random
> crap that is background noise on today's networks, or are there other
considerations?
The box happily rejects all the noise. The HW FW logs are skimmed daily,
but no real alerts are installed. Fully aware a persistent *smart*
attacker could likely easily DoS it, or perhaps worse. Latest (known
good) firmware on the FW as well.
>
> What's your trade-off model? If it *does* get whacked, what are the
> consequences? Remember to *NOT* spend more time/money/effort on
securing it
> than you would lose if it was in fact compromised.
The "time" is something "free" at this point. To be honest my "friend"
(ahem) is one of those who has installed various flavours of Linux
several times. Truth be told he (I) would prefer to move the web server
to a more hardened Linux box but it's "easier" at this point to just
deal with everything in one place.
> If it's a personal machine, you're just using Apache to serve up
photos of the
> barbeque to your friends, and the worst that happens is you have to
reload your
> 'My Documents' folder off a CD-ROM backup, you're probably *very*
safe. Just
> remember to not piss off a script kiddie on IRC. ;)
I don't use the windows FS like MS might like me to. All the server docs
are on a separate drive, backed up weekly or more often as needed. "My
Documents" contains a few things unintentionally misfiled long ago when
I was using IE for some random site. Indeed, it's 95% personal stuff.
"Work stuff" is simple consulting gigs or mirroring for friends.
>
> If you're using the machine to access a corporate database, you
probably want
> to do some more policy-level and ACL hardening on the inside - the
biggest
> threat to your HR database is still an underpaid secretary in Accounts
> Receivable.
Nope. No corporate remote access from this box (although a VPN'ed laptop
with a different OS is occasionally used from the same subnet).
>
> If you're using the machine in a true life-or-death environment (medical
> monitoring, processing classified data, launch codes, etc), you're
nowhere near
> hardened enough.
Only life or death would be loss of connectivity. :) Nowhere near that
important...
-jim
Powered by blists - more mailing lists