Re: border filtering questions

[Anthony Maszeroski <maszeroskia3 () SCRANTON EDU>]

On 2/28/2011 1:41 PM, Jeff Murphy wrote:
> Good Monday Sec Folks, 
>
> If you have a moment, can you hit reply, check the appropriate box and
> fill in the blank if there is one under that box?
>
>
>
> [  ]  We don't block traffic to/from known bad addresses/netblocks at
> our border. 
>
>
>
>
> [  ]  We *manually* *block* traffic to/from known bad
> addresses/netblocks at our border 
> (someone logs into a device and types in the address/netblock. frequency
> can be rarely-to-routine, I'm interested in whether you do it at all)
>
>
>
>
> [  ]  We *automatically** *block* traffic to/from known bad
> addresses/netblocks at our border *using a border router (ACL) and
> free/homegrown software *(software talks directly to the router)
> (*using some feed of addresses/netblocks, for example obtained via a
> SIEM or external intelligence sources)

We do standard best-practice border filtering in ACLs and also peer with
Team Cymru for their bogon feed.

> [  ]  We *automatically** *block* traffic to/from known bad
> addresses/netblocks at our border *using a border router (ACL)
> and commercial software *(software talks directly to the router)
> (*using some feed of addresses/netblocks, for example obtained via a
> SIEM or external intelligence sources)
>
> What's the name of the commercial software package/vendor: _____
>
>
>
>
> [  ]  We *automatically** *block* traffic to/from known bad
> addresses/netblocks at our border *using a commercial inline
> appliance **(IPS, packet shaper, firewall) **and free/homegrown
> software *(software talks directly to the appliance)
> (*using some feed of addresses/netblocks, for example obtained via a
> SIEM or external intelligence sources, the feed is directly consumed by
> the appliance and not manually entered or pushed in via free/homegrown
> software)
>
> What's the name of the appliance vendor: _____

We feed DNS reputation data into our Tippingpoint IPS. We also use
internal scripts to detect various forms of badness and use the IPS APIs
to block the traffic.

> [  ]  We *automatically** *block* traffic to/from known bad
> addresses/netblocks at our border *using a commercial inline
> appliance* * (IPS, packet shaper, firewall) **and commercial
> software *(software talks directly to the appliance)
> (*using some feed of addresses/netblocks, for example obtained via a
> SIEM or external intelligence sources, the feed is directly consumed by
> the appliance and not manually entered or pushed in via free/homegrown
> software)
>
> What's the name of the appliance vendor: ______
> What's the name of the commercial software package/vendor: _____
>
>
>
> Jeff, your survey is weak! I want to tell you more! Here it is: _________
>
>
>
>
> I'll anonymize/summarize back to the list.
>
> thanks,
>
> jeff murphy
> information security program manager
> university at buffalo

-- 
- Anthony Maszeroski, CCNA, CISSP
-----------------------------------
Information Security Manager
The University of Scranton
email : maszeroskia3 () scranton edu
phone : 570-941-4226
-----------------------------------