Re: Firewalls and PCI
- From: "Brian Johnson" <brian.l.johnson@xxxxxxxxx>
- Date: Wed, 16 Jan 2008 10:28:03 -0600
How does a lack of DHCP let you KNOW who is on your network? Absent
DHCP all an attacker with zero knowledge of the network configuration
needs to do is sniff the ARP and other broadcast traffic to determine
the addressing of the network and find themselves an open address or
takeover a used address. Now if you have 802.1x or use IPSEC to limit
communications that is another story entirely and can still function
A number of clients I visit say that lack of DHCP is a security
measure. If they push back on my claim it would only slow an attacker
down I demonstrate just how easy it is to find an open address, I end
up able to talk to their network inside of 5 minutes.
You have a VERY SMART client!!
This is an architecture I have been pushing for years: Isolate every
individual zone of security with a firewall.
Another issue I see consistently ignored: You NEVER have a clue who is
on any DHCP network. Therefore, anything running DHCP should be on a
physically separate network that is considered only very very slightly
more trusted than the Internet. And needless to say, this network must
be isolated from the rest of the organization's internal network using
a firewall. Also, please note that the same applies to ANYTHING wireless.
I have an organization where I have just implemented a multi-location
network, and each location's LAN is isolated on the WAN via a firewall
(and one or two routers) from the rest of the WAN. Any site with exposed
services has an Internet-facing router, a hardware firewall, DMZ servers,
a hardware firewall, the LAN, and on LAN:
a) a hardware firewall that isolates WAN/LAN servers
b) a hardware firewall that isolates the site from the WAN, and the
c) a hardware firewall that isolates a DHCP network.
Finally, EVERY host should have a good (e.g., not M$) firewall. I am
very please with Sophos' end point security product in this respect.
Hope this helps! (And pay attention to your client's good ideas!)
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC USA
Filtered by: TRUSTEM.COM's Email Filtering Service
No Spam. No Viruses. Just Good Clean Email.
- Re: Firewalls and PCI
- From: Jon R. Kibler
- Re: Firewalls and PCI
- Prev by Date: VoIP
- Next by Date: Re: ISO IEC 27002 (ISO-17799) assistance please.
- Previous by thread: Re: Firewalls and PCI
- Next by thread: Re: Firewalls and PCI