Arg! The money spent the month before I stated here.
-
@storageninja I don't have compliance requirements and I just asking about the definitions-based ACL because it makes sense and I prefer it over lines of IPs and networks.
-
@wrx7m said in Arg! The money spent the month before I stated here.:
@jaredbusch Right but my question was related to ACLs, not IDS/IPS.
Then you need to define what you are after. Of course the firewall uses rules. There is not a firewall in existence that does not.
Here are the firewall rules currently in my ERL at home.
jbusch@jared# show firewall all-ping enable broadcast-ping disable group { address-group Strongarm.io { address 54.174.40.213 address 52.3.100.184 description "" } } ipv6-receive-redirects disable ipv6-src-route disable ip-src-route disable log-martians enable name LAN_IN { default-action accept description "Wired and Wireless LAN to Internet" rule 2 { action reject description "Block Port 25" destination { port 25 } log enable protocol tcp } } name LAN_LOCAL { default-action accept description "Wired and Wireless LAN to Router" } name WAN_IN { default-action drop description "WAN to internal" rule 10 { action accept description "Allow established/related" state { established enable related enable } } rule 20 { action drop description "Drop invalid state" state { invalid enable } } } name WAN_LOCAL { default-action drop description "WAN to router" rule 10 { action accept state { established enable related enable } } rule 20 { action drop log enable state { invalid enable } } rule 30 { action accept description "Allow Pings to Router" limit { burst 1 rate 62/minute } log enable protocol icmp } rule 40 { action accept description "Allow IPSEC" ipsec { match-ipsec } log disable protocol all state { established disable invalid disable new enable related disable } } } name WAN_OUT { default-action accept description "" rule 1 { action accept description "Allows Strongarm.io DNS" destination { group { address-group Strongarm.io } port 53 } log disable protocol udp state { established enable invalid disable new enable related disable } } rule 2 { action drop description "Block all DNS" destination { port 53 } log enable protocol udp state { established enable invalid enable new enable related enable } } } -
@jaredbusch I know firewalls use rules. In Sophos and Sonicwall and others, I'm sure, you can define a host, network and service and call it something like ServerA and drag and drop the hosts/ip address, services and networks to create the rules.
-
@storageninja said in Arg! The money spent the month before I stated here.:
@wrx7m said in Arg! The money spent the month before I stated here.:
@jaredbusch Right but my question was related to ACLs, not IDS/IPS.
Did they have compliance requirements that would drive IDS/IPS? Honestly, I wouldn't deploy an office network without some sort of layer 7 edge inspection. Users are just too dumb...
The modern argument against proxy and IDS/IPS is that you have to set it up so that your proxy device is the man in the middle and decrypts and encrypts everything again.
-
@wrx7m said in Arg! The money spent the month before I stated here.:
@storageninja said in Arg! The money spent the month before I stated here.:
@wrx7m said in Arg! The money spent the month before I stated here.:
@jaredbusch Right but my question was related to ACLs, not IDS/IPS.
Did they have compliance requirements that would drive IDS/IPS? Honestly, I wouldn't deploy an office network without some sort of layer 7 edge inspection. Users are just too dumb...
The modern argument against proxy and IDS/IPS is that you have to set it up so that your proxy device is the man in the middle and decrypts and encrypts everything again.
That was an old argument, too
-
@scottalanmiller Right, but now almost everything is HTTPS.
-
@storageninja said in Arg! The money spent the month before I stated here.:
@wrx7m said in Arg! The money spent the month before I stated here.:
@jaredbusch Right but my question was related to ACLs, not IDS/IPS.
Did they have compliance requirements that would drive IDS/IPS? Honestly, I wouldn't deploy an office network without some sort of layer 7 edge inspection. Users are just too dumb...
No compliance related things, yet at least.
-
@wrx7m said in Arg! The money spent the month before I stated here.:
@scottalanmiller Right, but now almost everything is HTTPS.
Oh, I see what you mean.
-
@wrx7m said in Arg! The money spent the month before I stated here.:
@jaredbusch I know firewalls use rules. In Sophos and Sonicwall and others, I'm sure, you can define a host, network and service and call it something like ServerA and drag and drop the hosts/ip address, services and networks to create the rules.
An ACL provides rules applied to IP address and ports.
What you are describing is not an ACL. It is a group or list of information applied to an ACL.
In the VyOS/EdgeMax world, you can see an example in my router snippet above. I have a firewall group named Strongarm.io that is an address group of two addresses.
That group is applied to rule 1 of ACL named WAN_OUT
-
@wrx7m said in Arg! The money spent the month before I stated here.:
@jaredbusch I know firewalls use rules. In Sophos and Sonicwall and others, I'm sure, you can define a host, network and service and call it something like ServerA and drag and drop the hosts/ip address, services and networks to create the rules.
An object based rule engine. This is what most modern firewalls have moved to.
-
@wrx7m Inbound attacks on systems you are hosting it's still an issue (and yes, your IDS/F5/LB's need to terminate SSL for this to work). On the outbound traffic, there's a lot that can be inferred from what/where you are talking to. If someone is phoning home to a known bot C&C system then you likely want to know that...
-
A lot of malware such as ransomware is delivered from legitimate SSL sites that have been hacked.
So if you don't have some kind of SSL Inspection (like SonicWALL's SSL-DPI), then you are solely relying on your users' AV and ability to spot fake "java update" ads for example.
-
@tim_g said in Arg! The money spent the month before I stated here.:
A lot of malware such as ransomware is delivered from legitimate SSL sites that have been hacked.
So if you don't have some kind of SSL Inspection (like SonicWALL's SSL-DPI), then you are solely relying on your users' AV and ability to spot fake "java update" ads for example.
You are relying on the same thing in both cases, just one runs no a central processor and one runs closer to the end user. Same scanning functionality, though.
-
@tim_g said in Arg! The money spent the month before I stated here.:
...and ability to spot fake "java update" ads for example.
No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.
-
@scottalanmiller said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
A lot of malware such as ransomware is delivered from legitimate SSL sites that have been hacked.
So if you don't have some kind of SSL Inspection (like SonicWALL's SSL-DPI), then you are solely relying on your users' AV and ability to spot fake "java update" ads for example.
You are relying on the same thing in both cases, just one runs no a central processor and one runs closer to the end user. Same scanning functionality, though.
Security in layers... why not one at the gateway?
-
@scottalanmiller said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
...and ability to spot fake "java update" ads for example.
No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.
It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.
And the other helps against things that pass do through the firewall (like a pc connecting to the internet). Both together are better.
The SonicWALL may catch something the other does not.
The SonicWALL may deny something that an unprotected device can't see... like an iPAD with no antivirus or a cell phone on the wireless network.
-
@tim_g said in Arg! The money spent the month before I stated here.:
@scottalanmiller said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
...and ability to spot fake "java update" ads for example.
No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.
It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.
And the other helps against things that pass through the firewall. Both together are better.
Why do you need to pay so much money when you can get the same functionality free? That's my beef, not that security in-depth isn't a good thing.
-
@travisdh1 said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
@scottalanmiller said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
...and ability to spot fake "java update" ads for example.
No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.
It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.
And the other helps against things that pass through the firewall. Both together are better.
Why do you need to pay so much money when you can get the same functionality free? That's my beef, not that security in-depth isn't a good thing.
Where do you get good SSL-DPI for free, with reliable gateway AV?
-
@scottalanmiller said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
...and ability to spot fake "java update" ads for example.
No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.
I meant the user spot fake ads there.
-
@tim_g said in Arg! The money spent the month before I stated here.:
@travisdh1 said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
@scottalanmiller said in Arg! The money spent the month before I stated here.:
@tim_g said in Arg! The money spent the month before I stated here.:
...and ability to spot fake "java update" ads for example.
No, that's not how that works. Anything that runs on the router can be run on the client machine. The idea that UTM can do something that traditional AV cannot is incorrect. It's the same thing, just one runs on a low powered shared machine and one runs on the high powered desktop.
It works because one protects against stuff that bypasses the firewall... like if you plug in an infected USB stick, or some other means of bypassing the firewall.
And the other helps against things that pass through the firewall. Both together are better.
Why do you need to pay so much money when you can get the same functionality free? That's my beef, not that security in-depth isn't a good thing.
Where do you get good SSL-DPI for free, with reliable gateway AV?
Every proxy server around offers that.
