I am looking for a managed SIEM solution.
I see this same topic posted in 2018 and I'd like to see what the recommendations would be for 2023! Managed SIEM / SOC as a Service for SMB - 2023 update! Security.or second way is to use windows firewall inbuilt network definitions (way cool) - on the rule edit the scope, Remote IP Address, use the "predefined set of computers" option to select something suitable such as: 'local subnet' First is by explicit subnets (traditional ACL) - create allow rule for local network, then a deny all rule. Still ANY firewall can just have a specific deny rule placed in for this host. they have one chunk for webservers and it allows port 80 in.
What the firewall guy meant was - we didn't design the current setup and rules that way - e.g. You always start with the most outer line of defense - don't let it in and it can't be exploited. And then should also be blocked on the host firewall. It must be blocked on the external firewall. Would the firewall have some kind of reverse proxy features, it still might be an option to deny access to a selected website. What kind of webserver are we actually talking about? Microsoft IIS? Apache?.? The best way would be, to use the webserver and the options it is offering to limit access. However - if this is true, the same problem will be introduced, if you block port 80 on the server itself. By denying access, it could break access to them. So it could be possible, that this web server is a multihomed, hosting multiple public websites.
What made me listen, was the wording, that disabling the firewall rule WILL ALSO DISABLE ALL OTHER WEBSITES. Well, I'm not so sure - possibly you are judging too fast. Rules are processed in order, and the first rule to match gets used. The rule needs to be above the rule granting http/TCP-80 traffic to the DMZ from the Internet. This should be easily achieved by putting in a deny rule for http/TCP-80 traffic from the outside to the particular DMZ server. You need a MUCH better person to manage the firewall. So my only option is to do this in the windows firewall. But i am not managing the corporate firewall and the firewall administrator told me that the rule is setup in a way that this will also include all other webservers? For me that sounds very odd.
0 kommentar(er)
