3 ms·
The author is failing to see a potential solution. Whitelist all needed IPs for business functionality, enable the whole Internet once every 3 hours for an hou
by fifteen1506 2y ago
The author is failing to see a potential solution.
Whitelist all needed IPs for business functionality, enable the whole Internet once every 3 hours for an hour.
Bonus points if you can do it by network segment.
It would be enough to spare half your computers from the CrowdStrike issue, since I believe the update was pulled after an hour.
Will any-one do this? Probably not. But it is worth entertaining as a possibility between the fully on connectivity and the fully disconnected.
- vel0city 2y ago> Whitelist all needed IPs for business functionality I really don't like this mentality. The IP I'm serving some service might change. DNS is a useful thing.
- deathanatos 2y agoSecurity types love it. But from a infra eng viewpoint, it's an utter pain in the ass, and the thought of "what if IP changes?" — which inevitably happens — has no process, no plan, and ends up as "manually update O(n) different configurations, of which there does not exist a list of, so you'll never know if you got them all."
- fifteen1506 2y agoYou're of course right. My proposal would fall flat on its face the moment that ocurred. Doesn't mean it couldn't work. See for example, Microsoft's ZeroTrust DNS.
- deathanatos 2y ago> It would be enough That depends on the phase of your "every 3 hours for an hour" signal, and the phase of "the update was pulled after an hour.". That's a 33% overlap. Feelin' lucky?