Tag Info

Hot answers tagged

3

First of all, I'm not sure where you doubters have been for the last few years, but the requirement for a WAF in PCI is one part of requirement 6.6, and it's been the most talked about requirement of the last few years. (I would post a link, but since I'm new I can only post one link per message, and I'm saving it. Just google "6.6 PCI WAF" and you'll have a ...


3

That is an extremely open ended question. A firewall can be software or hardware, free or tens of thousands of dollars. It really depends on your needs and budget as far as "best". Of course, in the end, when you say "best", I say: Cisco. Note that the term "web application firewall" also means different things to different people. To Cisco, it seems to ...


3

I have tested a number of different Web Application Firewalls from many the major hardware and software vendors. None of them have really had any noteable affect on my ability to manually expose the problems in vulnerable web applications. They are getting pretty good at stopping the kind of attacks that worms, or unseasoned attackers may try, but a ...


2

An IPS will help, simply by noticing some attacks against your reverse proxy/webserver/sql injections and so on. The real question is not "will an IPS help" though, but "is the benefit of an IPS worth the extra cost and complexity it will add to my network". No one is going to be able to give you a definitive answer for that, however, assuming you're running ...


2

My question is, being that this is a managed switch and needs an IP, will I still be able to run my public ips through it? If the switch has a console port, the address is not required. Will I have to assign the switch a public IP address in this range as well for it to "route" to those other devices or does the switch does not care what IPs goes ...


2

The easiest way is to use pkgrecv to pull the package from a source repository to a local repository. IPS is a network package system so you can't currently install packages from a single file like you could with SVr4 datastreams. Last I heard (before the Oracle takeover) was that the pkg5 guys were working on an on-disk format but I don't think it got ...


2

Cisco IPS basically uses "signatures" which are nothing more than regular expressions.


1

You could move this question across to security.stackexchange.com - as it is an ideal question for that forum. A couple of us have tested/used DDoS solutions at an enterprise level. The one I am aware of required the ISP and DDoS protection provider to work together so a solution for you may be local specific.


1

I guess there are many ways to accomplish this. Keeping in mind what you want to do, I would: hostA on netA | -------------------- IDS iface on netA IDS Host IDS iface on netB -------------------- | hostB on netB | inet hostB would have a default gateway which as it should already be set (a router on your ISP provider), ...


1

Typically stateful packet inspection is the industry standard for network security to address malicious attacker behavior. Since you are running an asymmetrical network where packets can come in and go out on different network segments your IPS probably cannot maintain the state for all transactions, it is highly likely that attacks will not be identified ...


1

do a netstat -pntle | grep :80 to see which process is running on this port. If it is apache, you need to configure it to listen only on one IP.


1

I had a similar problem. The sollution appeard to be simple - in jail.conf file I had two similar jails - "Apache" and "Apache Multiport" enabled. Both jails were using same filter and same log file as input. After commenting out jail "Apache Multiport" fail2ban started matching regex in log file correctly. PS. I am not using quotes in failregex and I am ...


1

You could try to disable incoming connections on the ports Teamviewer uses. I'm sure TV uses the following ports; 5938/tcp 80/tcp and maybe also 443/tcp 5939/tcp or maybe you can do something with the url TV uses for connection. *.teamviewer.* *dyngate* dont know if you need those urls for outgoing connections but you can test that.


1

It's impossible to block in traditional firewall. You'll need some kind of packet-analyzer. Or you could create a GPO that sets the following registry-key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TeamViewer\Version6\Security_AcceptIncoming REG_DWORD=0 This disables incoming connections.


1

A package in an IPS repository only makes sense within the context of actually installing the package via the pkg(1) command over the network. A package is not represented as a single file within an IPS repo; instead, the manifest file for a package keeps track of the various bits. My understanding is that this allows for efficient upgrades since only ...


1

The manifest is directly available http://pkg.openindiana.org/dev/manifest/0/developer%2Fbuild%2Fmake%400.5.11%2C5.11-0.151.1%3A20110912T022544Z. The only thing that remains is to figure out how to get those individual files, listed in this fashion file b8dac4eaeabc7d41b4bff842a2f6b54cb36449d7 chash=f3998eb4b0aa99b3c54682f1a765e19215e15622 group=bin ...


1

Correct. The ASA does not perform SSL termination (beyond that required for WebVPN and AnyConnect VPN), so it is unable to provide a decrypted data stream for the AIP to inspect. You would need to position something else in front of the ASA that can perform SSL termination, such as a Web application firewall, as you mentioned. Some load-balancing products ...


1

I'm with Cheekysoft, but I'd also regularly scan my Web applications for vulnerabilities with Nessus, Nikto, and (haven't tried yet but heard good things) with Google's recently released SkipFish. You may also be able to make your own informed decision from The Open Web Application Security Project (OWASP) guide to Web Application Firewalls: ...


1

I have tried several top of the line WAFs. Some come built-in with load balancers (think F5, Zeus). Others are dedicated, stand-alone WAFs. Tested numerous ones by actually running AppScan against known vulnerable web code. The top performer for me was Imperva's SecureSphere WAF. You're going to pay through the nose for it, but in terms of raw security, ...


1

Larry Suto recently did an analysis of WAFs which you might find interesting. I have no connection to him, but Imperva did well. http://www.manvswebapp.com/wp-content/uploads/Analyzing_Effectiveness_of_Web_Application_Firewalls.pdf For some balance, Ofer Shezaf, who was at Breach Security for several years and has been a contributor to the open source ...


1

For IIS consider Microsoft Threat Management Gateway (was ISA server). It is geared towards IIS and it is one of only three firewalls that have EAL4 + rated (the other two being ASA/PIX and Checkpoint). You can either install it on your own commodity hardware, or buy it as an appliance such as made by Celestix.


1

BIND has a transfer-source option that controls which local address is used to fetch zones. Add it to the options section of named.conf: options { // ... transfer-source t.t.t.t; }; With this option set, BIND will send out transfer request messages from t.t.t.t. Responses from the master will then be sent back to t.t.t.t. You will also need to ...


1

An IPS (such as a tippingpoint) can catch things like common SQL injection strings and other layer 7 attacks that a firewall won't catch. That means you do gain some added security as it's an additional layer (defense in depth approach) and poorly written code will be less vulnerable. I'm not sure if anyone can answer if such a thing is required or not


1

What are the syslogs from the 5510 telling you. The only time that the ASA will actually block any ips is if the IPS module issues a shun on the ASA for that particular IP address. Are you getting shuns? Do the IPs match up between the "Never Block Addresses" and the IP of the server? Otherwise you're in the right location in the IME.


1

You may want to add a filter rule for your scanning server. http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/idm/idm_event_action_rules.html#wp2034816


1

From your ASDM on the 5510, go to CONFIGURATION > FIREWALL > SERVICE POLICY RULES and disable the service policy rule that is diverting traffic to the IPS module


1

Try setting the MTU down on the sending side (in fact both sides will probably need it). Could be there is a device that's either not generating or not passing Path MTU discovery packets correctly. If lowering the mtu to, say, 1350 on both ends fixes it, then investigate whether you have ACLs blocking ICMP.


1

Have you considered buying a juniper netscreen type box? They're not super expensive if you buy on the secondary market and their sales force is super aggressive if you want to buy from them directly. As systems go, they're easy to manage, fast, and reliable.


1

You might try SmoothWall - (bias disclosure: I work for SmoothWall). You will certainly find the web filtering worth having, and whilst it won't talk to smartfilter necessarily, I am sure you will be able to negotiate a competitive upgrade. Support is also handled by "real" support agents, not script-botherers :)



Only top voted, non community-wiki answers of a minimum length are eligible