3 ms·
Network access (outgoing) should be firewalled a lot more these days.. There’s almost no need to open an outgoing connection
by jbverschoor 4y ago
Network access (outgoing) should be firewalled a lot more these days..
There’s almost no need to open an outgoing connection
- fmajid 4y agoIt’s tricky, though. Data could be exfiltrated by a DNS lookup or OCSP request.
- capableweb 4y agoI'm not familiar with OCSP, but DNS happens via UDP, and since parent said "network access", I'm assuming they mean all network protocols, not just TCP.
- kortilla 4y agoAny access to resolve global dns lets you exfiltrate even if you’re locked to a local resolver. Just blocking connections to the internet directly is not enough.
- capableweb 4y agoSure, but again, parent said "Network access" which I assume includes internet (global), local network or any other type of sockets/connections, not just "internet" ones.
- fmajid 4y agoNot all OSes’ resolver libraries use the network. Solaris/Illumos uses door IPC.
- WhyNotHugo 4y agoRight. Have a DNS servers which only forwards request to trusted domains, and a transparent proxy which only allows traffic to those same domains. This is not a new idea at all, but it's still a very good one.