RE: Learn from history?

["Stuart Fox (DSL AK)" <StuartF () datacom co nz>]

> > 3. If it is a port-related threat, find out if such ports 
> are in use, 
> > and if not, make sure they are closed. (Of course there would
>
> Once the virus is on the LAN it can do whatever it wants.
Not quite.  Anyone here using IPSEC filter group policies to block the ports
that Sasser uses to propagate?  Obviously you can't block 445 without
causing significant issues, but you can block the ports Sasser uses to
transfer itself (5554 & 9996).

Anyone here using IPSEC Filter Group Policies at all?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html