11–20 of 197 posts
Are there good tools for anomaly/intrusion detection on Linux? Even something as simple as comparing current resource usage with a baseline record of disk/network/CPU utilization.
Add network isolation to your defense in depth strategy. Close all link listeners and inbound firewall ports. Open authorized-only, outbound-only, ephemeral sessions.
Is Suricata a good option for network intrusion detection?
> If you’re not a cyber criminal or don’t have a lot of crypto to steal, this will probably never happen to you… This is a misunderstanding of the threat in two ways. First, malware is not purely, or even primarily, a targeted threat. It's actually a shockingly easy attack to scale, and by far the most victims are not any kind of high profile target. They are either unsophisticated or careless computer users, who ins…
The lack of per-application isolation with desktops is one of those ugly truths people try and sweep under the rug. I foresee two potential solutions to this. 1) Run everything in a VM like Qubes (essentially nerfs certain application like 3D acceleration without major R&D) 2) Utilize some container runtime to provide isolation for legacy applications and stub out features such as filesystem calls so they do not to b…
I mean, yeah? I agree, I guess? But also, that’s not an interesting observation, is it?
Add network isolation to your defense in depth strategy. Close all link listeners and inbound firewall ports. Open authorized-only, outbound-only, ephemeral sessions.
DNS and HTTPS are wide-open ports. Would be nice to have a subscription service that maps popular web services to known-good destination IP address ranges for firewall rules. Is Suricata a good option for network intrusion detection?
Secure isn't a binary state, it's a spectrum.
At the same time, what is my risk model? Are my NSFW activities THAT interesting? What about my personal notes that contain health details?
I keep an inventory of stuff in my home. Is that ok to keep in Dropbox? Sure the government can access it.. but even if a remote attacker does, is that useful to them?
And of course, as things get more secure they become less accessible. My "very secure" documents archive almost never gets updated.. cuz it's a pain to update it. My daily notes are just chucked in dropbox and get updated all day long...
The hypervisor itself will need to be well protected and you do not want that accessible from your client or the VMs and containers - use a seperate NIC or VLAN. This is the reason why you want a seperate server - the only things the client will see are the shared containers. Let's assume here that VMs and containers are secure - if they aren't, you can replicate this with seperate physical machines.
On the server you can set firewall rules to control access between the different containers. Network storage etc. can also be setup for the containers that need it, with different permissions depending on the situation.
Depending on the stuff you are running, you may want to go the VDI or SSH route. Also there are other options like XPRA, etc. depending on your requirements. The more segmentation you do (i.e. one VM for the dev envionment for a specific app, another for chat and email, etc.), your security will increase at the cost of usability.
I personally do this in a limited fashion (I have secure workstations and VDIs for handling of private/financial information), but do not go the full route of seperating everything out for day-to-day computing.
>Cuddy: "How is it that you always assume you're right?
>House: "I don't, I just find it hard to operate on the opposite assumption."
If you're on a personal desktop at home you've got to place some level of trust in it.
Same with local LAN.
Once you get to more sophisticated server microservices then you can start thinking of the various components as mutually untrusted (until proven otherwise)
One could filter much of the crapology somewhere safe, and then have a relatively tidy local browsing experience.
I'm too busy to take this idea past the handwaving stage, but it seems like someone should have already done the homework.