[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: azrues and selinux



"Koree A. Smith" <koree@ameth.org> wrote:
> I think he was just saying that being behind a NAT router was
> sufficient enough.  Which, for the most part, is true.

Hasn't been for a long time.  Even Firefox is suseptible to spyware,
unless you turn Javascript and other things off.  The small little
tools in a security appliance really help you KNOW when you have been
comprised.

> Most home users don't need a robust, stateful firewall if they're
> behind NAT.

First off, most of these 'Ritters run Linux or VxWorks, and _do_ have
a "robust, stateful firewall."  Understand that.

Secondly, this is _not_ about a layer-3/4 firewall -- let alone a
"allow everything out ... be my guest" firewall.

Since most people don't want to deal with deny-all-outgoing by
default firewalls, or tweak security, they are at the mercy of what
their clients do.  Which means you need at least a basic IDS to catch
96-99% of the common compromises.

Even *I* got hit last year -- with Mozilla/Firefox no less!

> Your only real concern at that point is spoofing,

Huh?  99.99% of your compromises will be browser-based.

> and then security flaws in the router itself.

Huh?  The router helps you _zilch_ when you're hit on the browser.

> While NAT isn't a firewall, it does offer some level of security,
> even if it is partially from obscurity.

Again, these 'Ritters _are_ SPF -- often with Linux or VxWorks. 
Don't mistake that.

> If one starts forwarding ports, that can change things...

Port forwarding services is typically not the main issue for home
users, period.  The superstore SOHO SPF _died_ as a _minimal_ amount
of protection at least 2-3 years ago.

Having an IDS catch a major piece of spyware on your network within
the first 12 hours is priceless.


-- 
Bryan J. Smith     Professional, Technical Annoyance
b.j.smith@ieee.org      http://thebs413.blogspot.com
----------------------------------------------------
*** Speed doesn't kill, difference in speed does ***

-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.