3 ms·
These backdoors in the news lately - Juniper and now Fortigate - are scary, but thinking back on 10 years in IT I've never operated in a network where SSH on ne
by INTPenis 11y ago
These backdoors in the news lately - Juniper and now Fortigate - are scary, but thinking back on 10 years in IT I've never operated in a network where SSH on network equipment was accessible to anyone without intranet access through either physical location or VPN.
On top of that I am now in an organization where we're starting to implement security levels on networks, anything above level 0 requires 2FA to access and you can never connect a lower level to a higher level. So best practices are a good thing.
- lfx 11y agoWhat are you using for 2FA?
- INTPenis 11y agoIronically enough Juniper Junos. :)
- Animats 11y ago"I've never operated in a network where SSH on network equipment was accessible to anyone without intranet access through either physical location or VPN." Doesn't help. The attacker just has to get user-level access on some machine on the intranet or in the data center, which can be obtained via other attacks. Then then can attack other machines via the local network to escalate.
- INTPenis 11y agoYes but best practices still apply for example client networks in office do not by default have access to network equipment. This is where VPN services like Junos (ironically Juniper) work well because they give you 2FA and group based access. So if you're not in the networking admins group then you have no reason to have SSH access to the networking equipment.
- Animats 11y agoThe weakest application in your server farm can provide a way into the local network. One of the reasons Amazon uses their own software-defined network switches is so they can limit internal connectivity within their "cloud" to prevent such attack escalation.