Comments on: Bolting on Security https://cosine.org/2007/09/14/bolting-security/ Life and Ruby and Security Wed, 14 Mar 2012 07:05:55 +0000 hourly 1 https://wordpress.org/?v=4.4.2 By: Cosine Jeremiah https://cosine.org/2007/09/14/bolting-security/comment-page-1/#comment-21 Sat, 15 Sep 2007 23:45:13 +0000 http://www.cosine.org/2007/09/14/bolting-security/#comment-21 I agree port 22 is often not scrutinized as much as it should be, but having previously been at a company that did scrutinize some port 22 connections before allowing it in the end, I can say that with SSH the protocol and server binaries are documented to a degree that makes it possible to answer the hard questions during the scrutiny. This is not so with port 445.

And let us not even get started with how ports 80 and 443 are abused through firewalls! :)

]]> By: Ryan https://cosine.org/2007/09/14/bolting-security/comment-page-1/#comment-20 Sat, 15 Sep 2007 07:49:36 +0000 http://www.cosine.org/2007/09/14/bolting-security/#comment-20 Security can never be bolted on afterwords, that’s true, but they security apparatus’s can be extended. Extension with security will never make you’re application more secure, that’s impossible, since how secure you’re application is is lowest common denominator.

What extension can do is provide user conveniences. Security in Windows 2003 at a protocol level is basically the same as 2000. Unfortunately both still by default enable support for the Windows 98 protocols. Windows 2008 changes this, but anyone can disable the Windows 98 protocols as is. So there we see subtraction adding to security.

At the same time, Windows 2003 and Windows 2008 make an administrator’s job much easier without reducing security. In an effective sense they raise it by making it more likely they’ll know how to or have time to make the appropriate choices. Though pure security may not change much, effective does. Of course, management may instead take the efficiency improvements and roll them into staff cuts or more work, or more process, but that is an age old cause of many problems.

As far as 445 goes, I’m not sure why it’s more highly scrutinized than 22. It may be a mistake that 22 isn’t more scrutinized. I’ve heard of plenty of attacks that originated here. In fact, most UNIX attacks I recall any details of did. Perhaps it’s just a community bias that would leave such blind spots.

I’d say in both cases, that these are need to know ports. Applications services should use ports that are easier to separately monitor and control if you’re approaching it from a security perspective. If you approach it from any other perspective they should use ports 80/443 exclusively to subvert all security restrictions. ;p

]]>