RE: Open All Outbound Ports?

["Bill Lavalette" <billl () cyberbase7 com>]

Tony -

Here is what is say...

First define the business need of the port to be opened..
Second provide the name of the business application that needs this port
open
third provide the project plan for implementation of the application.
fourth tell me who the business owner is for the project.

If they come up with these four things on a per port basis then use your
judgment.

<insert Joke> Adjust Security policy which denies proposed plan </end joke>

Seriously if you do not have one start one or at least get some corporate
backing on security since you stated that the firewall group goes to you
that indicates to me your a decision maker. I would also re-evaluate your
security team if they are making unsound requests. you are right in thinking
opening all outbound ports is a bad idea. classic example is here..

director of marketing takes laptop home.

director gets hacked via Trojan downloaded from non corporate mail.

director brings laptop back to work.

using netcat hacker sets up opens backdoor via a allowed port... and tunnels
out through a high port to avoid detection.

your firewall team wont see this if the port is open...

Obviously there are many things that might catch the Trojan I.E. corp. AV
etc. but this is a classic order of events that could spell disaster for
you..

Hope this helps,

Bill Lavalette
Chief Security Officer
CyberBase7 Security Services METRO-SOC
Email:Operations () cyberbase7 com
http://www.cyberbase7.com




-----Original Message-----
From: tony tony [mailto:tonytorri () yahoo com]
Sent: Thursday, November 07, 2002 7:34 PM
To: security-basics () securityfocus com
Subject: Open All Outbound Ports?


Hi,

Our firewall group has came to me several times over the last few months
wanting my approval to open all of the OUTBOUND ports on our firewall
facing
the internet.  Their argument is that this would not significantly reduce
our
security and it will reduce their time/effort in administration.  They claim
they get several requests a week to open up out bound ports and the number
keeps growing each month. They want to go for the gustoand open up all
65,000+
outbound ports.

I am in the security area and they want my agreement/sign off before they do
this.  It just does not feel/smell right but I am losing ground with my
arguments.  What are some good arguments I can use?

Tony


__________________________________________________
Do you Yahoo!?
U2 on LAUNCH - Exclusive greatest hits videos
http://launch.yahoo.com/u2