Re: DNS Names for external services

[orca Puget <klrorca () hotmail com>]

DNS entries really don't matter much when it comes to security. A port scan will revel the port you have open to the 
internet and unless you changed them from the standard ports, a good guess is if 47,1723 (ptpp), 115 (l2tp), 
500,4500,10000 (IPSEC) are open you are running the associated protocols. However were attacking you, I would look for 
something easier to attack than VPN anyway, like a IIS vulnerability on port 80. 

If I were to attack you via DNS I would much rather try to poison your DNS cache and send your users to a web page of 
my design and hopefully gain access through I.E. vulnerability, get the user to download my Trojan, etc. 

> From: jbehm () burnsmcd com
> To: firewall-wizards () listserv icsalabs com
> Date: Tue, 13 Apr 2010 11:16:06 -0500
> Subject: [fw-wiz] DNS Names for external services
>
> Just curious, what is your opinions of the security vs. ease of use trade-offs on putting DNS entries in (vs. making 
> people know/use an IP address) for services you expose to the Internet.
>
> For example, 
>
> webmail.companynamehere.com for your webmail service
>
> www.companynamehere.com for your web site
>
> The two above are typically common and don't cause me much concern. What about this next one?
>
> vpn.companynamehere.com for your employees to access your company's VPN server
>
> It's this last one that really begs the question. Should I just as well use the name 
> "attackmehere.companynamehere.com" rather than vpn.companynamehere.com. I searched around on the Internet, but 
> couldn't really find pros and cons...
>
> Just looking for opinions. There are no "right" answers ;-)
>
> Jeff
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () listserv icsalabs com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
                                          
_________________________________________________________________
The New Busy is not the old busy. Search, chat and e-mail from your inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_3

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards