On Fri, Mar 03, 2006 at 06:47:34PM +0100, Loïc Minier wrote:
> Hi,
>
> On Fri, Mar 03, 2006, Henrique de Moraes Holschuh wrote:
> > Inside the network? Most managed networks have filtering at the borders, at
> > key router nodes, and if it has a more advanced distributed-firewall
> > mentality, on the all of the important boxes themselves (but that usually
> > doesn't reach the workstations).
>
> I thought security people would recommend havin a per-port ACL for
> allowed traffic, and port visibility set to limit the view to only the
> router when not otherwise required.
I don't think you have seen many corporate (i.e. hundreds of nodes) networks.
I've "seen" a few, and, from my "limited" experience:
a) people in charge of switches do not belong to the IT security department
(there's a whole communications department for level 2 and even inter
network routing)
b) it is not possible to set per-port ACLs for traffic since services are not
completely defined ("are you sure that the people in management don't have
to access the file servers at engineering?") and there's just too many
end nodes (with new ones being introduced and old ones removed from the
network continously)
c) there are multiple routing entities in the network (not just the border
router) due to having multiple interconnected LANs (some really nasty and
*big* networks are a single LAN, but that's difficult to handle). So the
needed visibility for a host is more than just a single router.
d) ACLs in core routers (think Cisco Catalyst) only buy you so much
security-wise (it might prevent IP spoofing but they are not, after all,
stateful filters) and has performance considerations (specially if you
are running Gigabit)
So even if the "security people" as you so put it, would recommend per-port
ACL allowed traffic they would (and do) get shunned by other IT departments.
At most, IT security can get a bridge firewall [1] setup between sensible
networks to isolate and try to control traffic between them.
> I completely agree that it's quite common to have the network filtered
> at its borders, and that's usually considered some internal trusted
> network.
With people bringing laptops (and all kind of devices) from the outside of
the network, unprotected/uncontrolled WiFi access points, etc. there is no
such thing as an "internal trusted network".
Regards
Javier
[1] Some call it IPS, but then again, that's were the hype now is... or
was... you never now.
Attachment:
signature.asc
Description: Digital signature