I think the important thing here is where Strykar says 'supposedly secure'.
What are the risks that you can see on that network? Are there enough risks
to tip it past the 'trusted' point.
Granted, 'trusted' is just a label, and not a metric as such here.
I know the word has a meaning in the 'inside of the perimeter and not the
DMZ' sense but what else does it mean to people?
Scott Ramsdell said:
Even on my trusted LAN, I only allow echo request/echo reply.
Which made me wonder, is that a 'trusted' LAN then? Different networks have
different needs and different risks to address.
When does it stop being trusted? Because it's outside a firewall? Behind a
router? Because I don't know the people using the clients on the LAN? What
does everyone else think?
Obviously I don't trust some of my users not to mistakenly or purposefully
access risky websites or services-otherwise I wouldn't have controls in
place to mitigate that. But they are on my 'trusted' LAN.
So trusted seems a fuzzy concept here; a human word for a human situation.
Personally, I'd find it very difficult to do my job without Mike Muss'
awesome little program, ping. So blocking ICMP is not going to happen on the
inside...of my, uh, trusted LAN.
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Strykar
Sent: Wednesday, March 26, 2008 10:30 AM
To: security-basics@securityfocus.com
Subject: RE: Removing ping/icmp from a network
You don't discourage ICMP on a network, that's uninformed Jim the farmer
cum
Sysad talk.
- S
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On
Behalf Of Secure This
Sent: Tuesday, March 25, 2008 10:00 PM
To: security-basics@securityfocus.com
Subject: Removing ping/icmp from a network
I have a variety of clients with data centres who all make use of
icmp/ping to monitor their servers/appliances/devices (often with poorly
configured snmp versions 1 and 2).
Could anybody kindly advise me of tools and strategies for minimising or
removing the use of icmp/ping on a supposedly secure network?
Thanks in advance
