{"id":1223,"date":"1999-08-16T00:00:00","date_gmt":"1999-08-16T00:00:00","guid":{"rendered":"https:\/\/seegras.discordia.ch\/Blog\/?p=1223"},"modified":"2019-01-17T23:50:56","modified_gmt":"2019-01-17T22:50:56","slug":"network-security-by-half-wittedness","status":"publish","type":"post","link":"https:\/\/seegras.discordia.ch\/Blog\/network-security-by-half-wittedness\/","title":{"rendered":"Network Security by Half-Wittedness"},"content":{"rendered":"

\nHow to base your network security on misinformation, overreaction, nervousness and lawyers<\/i><\/div>\n
\n

Security cautiousness is a good thing, in the vast and wild cyberspace. A lot of networks don’t even have somebody who cares. But there are some sites which are security cautious, and there are different kinds of these: Those who care, and those who fear.<\/p>\n

Fear and Loathing in Cyberspace<\/h3>\n

There are a lot of companies out there who fear they could be attacked by some misfit and in turn create policies, buy firewalls and try to detect any behaviour which could be interpreted as attack. Particularly
\na lot of those companies are in the consulting or even network security
\nbusiness. And some of them quite internationally renowned. As soon some
\npossible sign of an attack is detected, hell breaks loose: sysadmins of
\nthe originating site of the possible attack are emailed, upstream
\nproviders informed, the CERT gets an email, even the police might be
\ncalled or a lawyer to write threatening letters. In the end it probably
\nturns out to be some user who tried to test it’s newest movie-streaming
\nsoftware. Or the sysadmin of the ISP did a portscan “to see what that
\nmachine does”. Maybe it even was intended maliciously, but it came
\nfrom somewhere in China. What had happened was in any case something
\nwith no importance and no actual impact which is now turned into a
\ngreat spectacle.<\/p>\n

A very nice case is the one of the Israeli “security”
\ncompany COMSEC
\nversus IOS++<\/a>, the Internet Operating Systems Counter. With great
\nincompetence COMSEC interpreted some weird packets which reached their
\nwebservers as attack, didn’t even bother to contact IOS++ but informed
\nthe press instead which promptly took up a story about widespread attacks
\nagainst the isreali part of the internet.<\/p>\n

Another typical case is people who want their DNS Zone transfers
\nblocked. Why would one want that when you just can do a zone transfer
\nof in.addr-arpa and get the whole thing anyway? This is typical for
\nwrong understood network security. It’s called security by obscurity,
\none tries to hide something, and it never works. There are certainly
\nthings outsiders ought not know, but certainly not which hosts you’ve
\ngot on your external network. If you’ve got no internal (private) and
\nexternal (for the public) network, you’ll be probably in trouble
\nanyway…<\/p>\n

Of course, this is not the only case, I had at least three cases of
\noverreaction last year (one involving a user trying to stream some
\nmovies and two portscans), and one demand of restriction of
\nzone-transfers from a big international consulting company which
\nreally should know better.<\/p>\n

What we have here is security cautiousness backed by a half-witted
\nknowledge about network security. People who know nothing about
\nnetwork security don’t fear a security breach, neither do people
\nwhich really know what network security is all about. It’s those who
\nknow a bit, but not enough, who fear and cry.<\/p>\n

Why should a sysadmin start crying about some possible attack which
\nfailed anyway, because the sysadmin keeps his systems updated and
\nknows that some 13 year-old script-kiddie will fail against his
\nwalls anyway?<\/p>\n

How-NotTo<\/h3>\n

Essentially, there are two forms of misbehavior when it comes to
\nsecurity (not counting the case of being NOT security cautious):<\/p>\n