Re: [tlug] Ping vs www server

["Josh Glover" <jmglov@example.com>]

On 18/04/2008, Curt Sampson <cjs@example.com> wrote:

> On 2008-04-17 19:05 +0900 (Thu), Josh Glover wrote:
>
>  > I think the idea is to simply not expose anything that is not
>  > necessary, as every service that accepts packets on your end is a
>  > possible attack vector.
>
> Indeed. But I don't see a lot of people shutting down their web servers
>  because of this.

What I meant was that you need to weigh the... wait one:

>  As you know, security is always a tradeoff.

Yes, I do. I consider turning off ICMP a good tradeoff, because being
able to ping my box offers me very little utility (especially since I
am behind several NATs, courtesy of my ISP), whilst opening a tiny
attack vector that is, as you note, very unlikely to be compromised.
Still, when I weigh "no utility" against "minuscule risk", guess which
wins?

>  My opinion is that, in
>  general, disabling ping is a poor tradeoff; it hurts the bad guys very
>  little, if at all, and hurts the good guys much more.

You are entitled to your opinion, of course; I just respectfully
disagree. My security pedigree may or may not be equal to your own,
but I at least Know Whereof I Speak to some degree, having been a
professional sysadmin at two different companies (of vastly different
scale) and being the primary security contact at two different
companies (on a similar scale). See my CV[1] for details.

>  > There are Other Ways to ping. :)
>
> Indeed. Other, more difficult and slow ways that vary from host to host.
>  nmapping a network is neither cheap nor quick, compared to using ping.

Again, trade-offs where my calculation and yours differ. As long as we
both have made the calculation, I see no problem here.

Cheers,
Josh

[1] http://www.jmglov.net/professional/