<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p> Well,</p>
<p>( I'm sorry but I cannot resist ) <br>
</p>
<p> Seriously mate, trolling this list using "deny-all is bad
m'kay" is not a good idea.<br>
</p>
<pre class="moz-signature" cols="72">-----
Alain Hebert <a class="moz-txt-link-abbreviated" href="mailto:ahebert@pubnix.net">ahebert@pubnix.net</a>
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911 <a class="moz-txt-link-freetext" href="http://www.pubnix.net">http://www.pubnix.net</a> Fax: 514-990-9443
</pre>
<div class="moz-cite-prefix">On 10/10/18 11:09, William Herrin
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAP-guGV8AMQ3PNqCxD0PNm1R9UUwao8gT_-JG0NThJsLE2JhJA@mail.gmail.com">
<pre wrap="">On Wed, Oct 10, 2018 at 10:22 AM Naslund, Steve <a class="moz-txt-link-rfc2396E" href="mailto:SNaslund@medline.com"><SNaslund@medline.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Allowing an internal server with sensitive data out to "any" is
a serious mistake and so basic that I would fire that contractor
immediately (or better yet impose huge monetary penalties.
As long as your security policy is defaulted to "deny all" outbound
that should not be difficult to accomplish.
</pre>
</blockquote>
<pre wrap="">
Hi Steve,
I respectfully disagree.
Deny-all-permit-by-exception incurs a substantial manpower cost both
in terms of increasing the number of people needed to do the job and
in terms of the reducing quality of the people willing to do the job:
deny-all is a more painful environment to work in and most of us have
other options. As with all security choices, that cost has to be
balanced against the risk-cost of an incident which would otherwise
have been contained by the deny-all rule.
Indeed, the most commonplace security error is spending more resources
securing something than the risk-cost of an incident. By voluntarily
spending the money you've basically done the attacker's damage for
them!
Except with the most sensitive of data, an IDS which alerts security
when an internal server generates unexpected traffic can establish
risk-costs much lower than the direct and indirect costs of a deny-all
rule.
Thus rejecting the deny-all approach as part of a balanced and well
conceived security plan is not inherently an error and does not
necessarily recommend firing anyone.
Regards,
Bill Herrin
</pre>
</blockquote>
<br>
</body>
</html>