Re: Re: January 15 is Personal Firewall Day,help the cause

[Jim Race <caferace () well com>]

Valdis.Kletnieks () vt edu wrote:

> What's your threat model?  Does it have to be "safe" against just the 
random
> crap that is background noise on today's networks, or are there other 
considerations?


The box happily rejects all the noise. The HW FW logs are skimmed daily, 
but no real alerts are installed. Fully aware a persistent *smart* 
attacker could likely easily DoS it, or perhaps worse. Latest (known 
good) firmware on the FW as well.

>
> What's your trade-off model?  If it *does* get whacked, what are the
> consequences? Remember to *NOT* spend more time/money/effort on 
securing it
> than you would lose if it was in fact compromised.


The "time" is something "free" at this point. To be honest my "friend" 
(ahem) is one of those who has installed various flavours of Linux 
several times. Truth be told he (I) would prefer to move the web server 
to a more hardened Linux box but it's "easier" at this point to just 
deal with everything in one place.

> If it's a personal machine, you're just using Apache to serve up 
photos of the
> barbeque to your friends, and the worst that happens is you have to 
reload your
> 'My Documents' folder off a CD-ROM backup, you're probably *very* 
safe. Just
> remember to not piss off a script kiddie on IRC. ;)


I don't use the windows FS like MS might like me to. All the server docs 
 are on a separate drive, backed up weekly or more often as needed. "My 
Documents" contains a few things unintentionally misfiled long ago when 
I was using IE for some random site. Indeed, it's 95% personal stuff. 
"Work stuff" is simple consulting gigs or mirroring for friends.

>
> If you're using the machine to access a corporate database, you 
probably want
> to do some more policy-level and ACL hardening on the inside - the 
biggest
> threat to your HR database is still an underpaid secretary in Accounts
> Receivable.


Nope. No corporate remote access from this box (although a VPN'ed laptop 
with a different OS is occasionally used from the same subnet).

>
> If you're using the machine in a true life-or-death environment (medical
> monitoring, processing classified data, launch codes, etc), you're 
nowhere near
> hardened enough.


Only life or death would be loss of connectivity. :) Nowhere near that 
important...

-jim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html