3 ms·
> Set up a guest network to enable internet connection for your guests and for your IoT devices. I would definitely recommend separating guest and iot networks
by zokier 2y ago
> Set up a guest network to enable internet connection for your guests and for your IoT devices.
I would definitely recommend separating guest and iot networks, iot is usually pretty weak (the S in IoT stands for security) so they need as much protection as possible; putting them to guest network is throwing them to wolves.
> Enable port filtering. For example, the SANS Institute recommends blocking outbound traffic
Tbh egress filtering is generally not very useful, except for some special case networks (like aforementioned iot network). Blocking IRC seems just silly.
> Use Media Access Control (MAC) filtering to choose which trusted devices connect to your network.
Afaik MAC filtering is pretty much useless, MAC is easily snooped and spoofed. WPA should be sufficient access control, go for EAP ("Enterprise") if you need better than PSK ("Personal") security.
> Disable remote access management
Realistically, not going to happen. Better advice would be to have separate management network, with tighter access controls.
- sambazi 2y ago> Tbh egress filtering is generally not very useful i found it sensible to log-drop non-internet traffic (rfc1918, linklocal ...) on internet-facing egress
- technion 2y agoKy feelings on egress port blocking have been one of the big changes in cyber security over the years, and I think a lot of best practise guides will take years to catch up. At one point you could restrict egress to certain ports and be reasonably confident in what was going on on a network. These days basically everything is tunnelled over port 443, including most malware communication.
- RedShift1 2y agoAnd then you have applications like Skype that need all ports: https://support.microsoft.com/en-us/skype/which-ports-need-to-be-open-to-use-skype-on-desktop-fe63a90c-f4a8-492c-8926-f3c3b2681a14 https://support.microsoft.com/en-us/skype/which-ports-need-t...
- zokier 2y agoAnd big part why everything is going through 443 is because of overzealous netadmins blocking everything else.
- codetrotter 2y agoBlocking IRC can be sensible. Some botnets use IRC for command and control. If you’re not using IRC yourself anyway, then you might as well block it. And let’s face it, most people don’t use IRC anymore. They’ll be using Discord instead.
- nexus6 2y agoStill makes me sad, that a private company's chat platform is a commonly used comms/support platform.
- fostware 2y ago> (the S in IoT stands for security) Yoinking that for later...
- froggit 2y ago> > (the S in IoT stands for security) > Yoinking that for later... Same. It took a couple seconds to proc that statement wasn't some kind of unique misprint or accidental slip up. Same thing happened when i first got a summary of IoT security in general.