3 ms·
Add network isolation to your defense in depth strategy. Close all link listeners and inbound firewall ports. Open authorized-only, outbound-only, ephemeral s
by gz5 5y ago
Add network isolation to your defense in depth strategy. Close all link listeners and inbound firewall ports. Open authorized-only, outbound-only, ephemeral sessions.
- walterbell 5y agoDNS and HTTPS are wide-open ports. Would be nice to have a subscription service that maps popular web services to known-good destination IP address ranges for firewall rules. Is Suricata a good option for network intrusion detection?
- gz5 5y agoI like that Suricata is open source but haven't used it. You can close all your inbound ports and link listeners, e.g. locally resolved DNS and outbound-only https, only for authorized sessions.
- vladvasiliu 5y agoYou can somewhat mitigate that with something like LittleSnitch (macOS) / OpenSnitch (Linux). I', quite sure I've heard of something similar on Windows, but I can't recall what it was. But I think that the included Windows Firewall is able to do per-application filtering, although I don't know if it's dynamic. The main advantage over a classic "filter firewall" is that it's able to work at the app level. Forbidding outgoing HTTPS traffic is going to be painful if you regularly use a browser. But that doesn't mean random_local_only.app should be able to reach anything on the internet.