topic Firewall Management - All Access Pass? in Network Security

Firewall Management - All Access Pass?

angel-moon — Tue, 12 Mar 2019 02:57:31 GMT

Hello All,

just wondering if the prevailing philosophy on firewall management is to 1) allow everything outbound and restrict inbound or 2) restrict both inbound and outbound?

We have a situation where we are getting hit with ZeroAccess Root Kit and it is occasionally changing the ports it uses. I can create an ACL that blocks a port each time it changes but that begs the bigger question of should we just restrict everything inbound AND outbound.

Thanks in advance. All replies rated.

Firewall Management - All Access Pass?

Karsten Iwen — Tue, 29 Oct 2013 16:59:51 GMT

Both philosophies are quite common, but it's obvious that the second group lives more secure. And even better in the second scenario if ports are not only just opened on demand, but if the needed traffic is also send through a L7-device like a filtering proxy for HTTP/HTTPS for example.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni