5 ms·
Company IT exists to serve the company. It should not cost more than it benefits. There’s a balancing act. On the one hand, you don’t want a one-week turnaro
by eadmund 2y ago
Company IT exists to serve the company. It should not cost more than it benefits.
There’s a balancing act. On the one hand, you don’t want a one-week turnaround to open a port; on the other you don’t want people running webservers on their company desktops with proprietary plans coincidentally sitting on them.
- graemep 2y agoThe biggest problem I can see with default deny is that it makes if far harder to get uptake for new protocols once you get "we only allow ports 80 and 443 through the firewall".
- account42 2y agoWich also makes the security benefit moot as now all malware also knows to use ports 80 and 443.
- graemep 2y agoYes, I think blocking outgoing connections by port is not the most useful approach, especially for default deny. Blocking incoming makes more sense, and should be default deny with allow for specific ports on specific servers.
- causal 2y agoThe problem is that security making things difficult results in employees resorting to workarounds like running rogue webservers to get their jobs done. If IT security's KPIs are only things like "number of breaches" without any KPIs like "employee satisfaction", security will deteriorate.
- cjalmeida 2y agoOne-week turnaround to open a port would be a dream in most large companies.