19 ms·
Yeah, well, not only HTTP*, but actually whitelisting whatever outgoing connection you may need. https://github.com/stripe/smokescreen https://github.com/stripe
by jve 5y ago
Yeah, well, not only HTTP*, but actually whitelisting whatever outgoing connection you may need. https://github.com/stripe/smokescreen https://github.com/stripe/smokescreen
Suppose you configured your webserver to run with limited privileges so as if someone hacks it it has limited access. Suppose it still has access to DB and stuff. Well, filtering outgoing connections makes harder to exfiltrate the data OR hop to another hosts. And then you can monitor failed outgoing requests to be able to act/investigate when that happens.
- stevekemp 5y agoYeah there are a bunch of tools like this - I'm using Aviatrix at the moment for a bunch of hosts: * Incoming access is allowed to "stuff" when connected to the OpenVPN host. * Outgoing access to services is very heavily restricted. * Outgoing HTTP/HTTPS requires the site to be on an allow-list. By default all outgoing HTTP/HTTPS traffic is denied. (We might add yum-repositories to the allowlist, or permit access to the various "Windows Updates" services, for example. But all other downloads from remote sites would be denied.)
- SahAssar 5y agoCouldn't an attacker exfiltrate over ssh or over an incoming HTTP connection instead of an outgoing? Or is this a defense-in-depth thing, not meant as a "hard stop"?
- jve 5y agoI see this as a defense in depth. It can buy you time until attacker figures out how to exfiltrate and you maybe notice via monitoring that something fishy is happening. It also prevents you participating in a DoS or other attacks.