On Sun, Mar 25, 2001 at 03:28:36AM -0300, Duwde (Fabio V. Dias) wrote:
> I don't think this is a good aproach. Nor does many people on the net
> thinking about security. And no, this ISN'T security by obscurity, I
> just don't like to let anyone know more than they need. If you don't
> care, I don't mind.
Yes, it is security by obscurity and no, most people thinking about security
on the net do not believe it is an effective technique to secure a site. You
secure a site by:
1. Only running services you actually need.
2. Installing good firewall rules.
3. Using any of the numerous IDS and NIDS systems.
4. Examining the source code for services you do run.
5. Not giving untrusted people accounts on your machine.
6. Having a policy in place for handling intrusions.
7. Actively monitoring security related lists and sites.
It shouldn't matter if people know what OS and/or software you are using. If
it does, then you may be in the wrong profession.
> Btw, This is my last post on this issue.
OK.
--
Note: See http://www.members.home.net/graywane/ for PGP information.
PGP signature
