Re: ICMP blocking

[David Lundy <dlundy () PACIFIC EDU>]

Gary:
     We block, but we got a minor ding from a recently completed
external sweep/vulnerability assessment by ISS because they were able to
get some ICMP responses.  They considered ICMP to be a security issue.
We don't know specifically what they observered.

David Lundy


----
David Lundy
Acting IT Security Officer
University of the Pacific
Stockton, CA 95211
Email: dlundy () pacific edu
Voice: 209-946-3951
Fax: 209-946-2898

> > > Gary Dobbins <dobbins () ND EDU> 12/06/06 1:24 PM >>>
Quick survey:  Who's blocking ICMP subsets (like echo requests,
traceroutes) at their borders?  Who's not?  Strong feelings about why
in
either case?

Certainly, doing so is not a huge security gain, but the alternative
means you're giving away the map anonymously.
How polar is the community on this?

Thanks.
--

   ------------------------------------------------------------
   Gary Dobbins, CISSP -- Director, Information Security
   University of Notre Dame, Office of Information Technologies