3 ms·
IMHO it can be done, using UNIX-based operating systems and standard open source software, if the infrastructure designer takes security seriously and is commit
by atmosx 12y ago
IMHO it can be done, using UNIX-based operating systems and standard open source software, if the infrastructure designer takes security seriously and is committed and knowledgeable.
It's NOT the system administrator's work to secure the network. The ISP/minor IT company should have a security engineer to overview the network, although some sys-admins are extremely skilled when it comes to security.
There are so many security layers that can be implemented on a Linux/BSD server that makes the machine virtually un-hackable and IF anyone enters, all bells and whistles could start cheering.
Examples: GRsecurity[1], IPTables[2], Snort[3], chroots (or jails), VPNs, malware scanners (clamav, spamassassin), encryption and what-not.
To me securing linux desktops, especially simple ones (e.g. window manager + basic programs... almost like thin clients) is easy. Securing Windows XP/7/8/etc is extremely tricky BUT can be done.
Once you do all that, I'm 100% that you're going to be one hell of a target for anyone. And you really don't trust your team you can always hire people to test your network's security and improve it.
The most important thing though is having a strict general user policy: What users can and can not do must be crystal clear with no exception. When a 'tiger team' finds a secure network, they usually target the people not the infrastructure.
[1] GRsecurity: https://grsecurity.net/ https://grsecurity.net/
[2] http://www.netfilter.org/projects/iptables/ http://www.netfilter.org/projects/iptables/
[3] https://www.snort.org/ https://www.snort.org/
- lawnchair_larry 12y agoHaha, no. Just no.
- erkkie 12y agoWhile not necessarily technically impossible, it's not plausible due to the asymmetric nature of blanket defense vs a targeted attack. It will always be difficult to protect against motivated targeted attacks.
- deleted 12y ago[deleted]
- bashinator 12y agoHow would anything you recommend protect you against an attacker who could (for example) have 3G transmitting keyloggers installed in your last shipment of laptops?
- atmosx 12y agoYou choose your hardware carefully and if paranoid enough, you perform statefull packet inspection on your OpenBSD transparent router to know possibly what's the reason/content for every connection. Once you tag those that are standard, you start narrowing things. Again policy is what matters, if you allow torrents you are making your job extremely difficult. I know easier said than done. Writing firewall rules/ confug reporting tools for every computer in the internal part of a network is hard too, that's why almost no one does it.
- bashinator 12y ago3G keyloggers. Data egress is completely bypassing your network. (There are pwnie express boxes that include a 3G data link for bypassing target networks when sending results back.) I guess you could add physical scans for unauthorized radio transmitters to your security routine. Opsec is hard.
- atmosx 12y agoSure, but that's a physical attack: You need someone to install the 3G Keylogger to your machinery. I was talking on a keyboard-only level, but even that can be largely mitigate with proper policies IMHO. That said, an insider is an achilles heel for every security scheme out there (e.g. Snowden).