331–340 of 343 posts
Earlier quoted context omitted.
I once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.
Talking about PCI compliance I always remember this: https://serverfault.com/questions/293217/our-security-audito...
Earlier quoted context omitted.
> Backblaze Test your backups. https://messengergeek.wordpress.com/2018/03/09/backblaze-rev...
People think of backblaze as a backup/archive but it is explicitly not an archive - it is a backup and if you delete a file on your system it is purged within 30 days from the copy. Most people don’t really think about this and expect that any backup is AlSO an archive. You can get burned by this and have to use b2 or whatever it is instead.
Earlier quoted context omitted.
Note that twilio-cli is a totally over-weight, un-necessarily complicated node.js app. If you just want to send SMS from the command line, the curl code is much, much cleaner.
I have not used twilio-cli for anything ... I just write my own scripts with curl - here is my basic 'sms' command: https://0x.co/6K37UZ
Earlier quoted context omitted.
> Never mind that a KISS setup tends to bring security because of its minimized attack surface Security is also about depth. You should assume breaches can happen and have another level of defense. That only increases the attack surface but it's a much better approach for imperfect beings.
In my experience that approach actually ends up leading to weaker security. When you have 5 or 6 security layers it's not clear which ones are important; people get confused about which parts can be safely bypassed and how, and you end up with a swiss cheese where sooner or later all of the holes line up. Having a really clear distinction between public and private services works better.
Earlier quoted context omitted.
> And you can make them tls-end for you. Nothing says end-to-end security like terminating TLS at a network choke point so intruders can easily snoop all traffic.
Case and point "SSL added and removed here! :)" https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her...
The phrase represents this idea: I have a case to make (or an argument), and there is a single element that is conclusive enough to make the whole case in and of itself.
You might say, "I can address this entire case in a single point." This shortens to "case in point." The implication is that the single point you make is enough of an argument to prove your whole case.
Earlier quoted context omitted.
I once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.
Well, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes). I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks). PCI prefers systems that handle CHD be "invisible" to th…
> I start the day with a short walk outdoors. I don’t want the first thing my eyes see to be print, and I don’t want the first thing my body does to be sitting. So I walk a bit.
Earlier quoted context omitted.
It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.
I did a job where I was given access to a server in the form of a set of credentials for an HPE iLO, which was accessible over the Internet. From there, we could use the remote console to logon as root. HPE iLO doesn't support MFA or any form of public key authentication, and its security history is much worse than SSH. It requires several ports open and the old version they had required Java plugins on desktops and…
Earlier quoted context omitted.
> I'm sure it can be done. IIRC, Cloudflare doesn't use any firewalls This is a little disingenuous because their product is a modern firewall. It drops packets and conditionally allows sessions to your backend.
While I agree with your assessment that Cloudflare serves as a modern firewall, I disagree with your assessment of disingenuousness. My lament was mainly at the more robotic and/or malicious "auditors" and "compliance officers" who will mark one or more line items as a critical failure if you don't have one or more Cisco Firepower/Juniper SRX/Fortinet Fortigate/Meraki MX/Barracuda NG/etc in your network such that its…
Cloudflare’s product is just a web application firewall as a service. It’s not magic. The major difference between Cloudflare and a pizza box WAF is the global distributed nature to absorb ddos in the same product. The things it does to the packets are the same though.