Re: Thoughts on Jericho Forum

[Cal Frye <cjf () CALFRYE COM>]

Bruce Curtis wrote:
>   I think a better model is to have hosts protect themselves and use
> native transport IPsec to connect to servers.  IPsec allows us to allow
> exactly the set of users to access a server, and only those users, no
> matter were they are.  No other users, even in the same subnet as the
> server can scan the servers for Microsoft vulnerabilities.

This becomes something of a management issue again, when you no longer
have a monoculture of server OS and a unified directory... Faculty-run
"servers" tend to have a default-permit strategy, whether born of
laziness or ignorance doesn't matter.

--
Regards,
-- Cal Frye, Network Administrator, Oberlin College

   www.calfrye.com,  www.pitalabs.com

"The gods too are fond of a joke. " - Aristotle (384-322 B.C.)