On May 10, 2011, Dobbins, Roland <[email protected]> wrote: On May 10, 2011, at 1:40 PM, Tracy Reed wrote:
> If you have traffic going out to a high numbered port and you are not keeping > state how do you know if that is a > reply packet to an existing inbound connection or if it is an unauthorized > outbound connection? >> You use stateless ACLs to filter outbound traffic as well, only allowing >> traffic >> originating from required well-known ports to ephemeral high ports. -------------------------------- The stateless ACLs would not prevent ACK tunneling (http://ntsecurity.nu/papers/acktunneling/). Although your infrastructure would be stronger against DDoS attacks, your environment would be more susceptible to covert channels and backdoors. If the organization security concern is mainly availability, I could agree in deploying a packet filter to protect external servers. However, if an external intrusion or sensitive data leakage would cause more damage to the organization's business or reputation, I would not recommend it. Additionally, the organization may have different DMZ's or external networks with different security levels. Regards, Bruno Cesar M. de Souza _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
