Security Basics mailing list archives
RE: Unrestricted Outbound Web Server Access Opinion
From: "Micro Kluge" <microkluge () hotmail com>
Date: Wed, 04 May 2005 11:39:36 +0000
Sounds like the first thing you need to establish is a sound methodology for making decisions such as this. Part of this process would include having the party asking for "x" define why they need it and how much will it save in time or resources?
Then you get to answer:What will it cost in time or resources? What is the risk either to cyber or physical security? etc...tons of different inputs to fit various environments.
I have found that alot of requests for "x" get washed away by putting them into this process, usually by the people requesting "X".
My simple 2c.
From: "Paul Guibord" <pguibord () tngtech net> To: <security-basics () securityfocus com> Subject: Unrestricted Outbound Web Server Access Opinion Date: Tue, 3 May 2005 08:54:57 -0400 Hello All, Someone within our company wants our Internet facing web servers to have unrestricted outbound access. Port 80 is the only port permitted from the outside coming in. I need the experts opinion why we do not want to permit this PLEASE. Two things I could think of are if the web servers were compromised, then the hacker would have the ability offload any data they want. Another being if they were infected with a worm they would bring down the Internet T1 in their attempt to find other devices to infect. Thanks in advance for everyone's input. Paul
_________________________________________________________________Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
Current thread:
- Unrestricted Outbound Web Server Access Opinion Paul Guibord (May 03)
- Re: Unrestricted Outbound Web Server Access Opinion Jon Hart (May 04)
- RE: Unrestricted Outbound Web Server Access Opinion David Gillett (May 05)
- Re: Unrestricted Outbound Web Server Access Opinion David Glosser (May 05)
- RE: Unrestricted Outbound Web Server Access Opinion Hamish Stanaway (May 05)
- RE: Unrestricted Outbound Web Server Access Opinion Micro Kluge (May 05)
- Re: Unrestricted Outbound Web Server Access Opinion Diego Kellner (May 05)
- Re: Unrestricted Outbound Web Server Access Opinion Mark Leonard (May 05)
- RE: Unrestricted Outbound Web Server Access Opinion Keenan Smith (May 10)
- Re: Unrestricted Outbound Web Server Access Opinion Chris Keladis (May 11)
- <Possible follow-ups>
- RE: Unrestricted Outbound Web Server Access Opinion Andrew Shore (May 05)
- Re: Unrestricted Outbound Web Server Access Opinion Jon Hart (May 04)