Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I understand that somebody would want to block incoming traffic as a general rule except for public resources. And I also understand that you could want to block all outgoing traffic except for certain external services.

But is there any serious security risk if I allow incoming traffic that represents responses to previous outgoing traffic, e.g. HTTP requests?

share|improve this question
    
stateful firewalls already do this without any additional configuration –  August Nov 16 '12 at 12:34
add comment

1 Answer 1

up vote 0 down vote accepted

Potentially the security risk is enormous. As a simple and common example: A compromised or malicious web site could infect or otherwise compromise the machine that was browsing the site, which in turn could cause all manner of problems on the rest of the network.

Such risks can be reduced and controlled of course using such things as sensible user level permissions, which will normally prevent the problem from spreading beyond the affected machine.

Organisations or departments that are really serious about security, such as some military and other government departments, don't allow certain machines or even entire networks to access the Internet for just these reasons.

For the vast majority of systems, with good management, of both IT systems and the people who use them, the risks are in reality fairly minor but never zero.

It's a balancing act. On the one side you have a secure network with no Internet. On the other you have a network that runs some risks but is able to use the many advantages of Internet access.

It's not much different to driving, or being driven in, a car. There is a very real risk of death but how many of us refuse to get in a car for that reason?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.