Networking Security ... How to do it
There has been a significant increase over the last few months in port scanning and other network invading issues. I started a "sticky" thread on another forum with a great deal of info on how to protect yourself from this increasing threat on the internet. Given the rapid increase in attempts to invade my own LAN over the last few days I have copied over the first 3 of 6 of my most important postings on this subject. So here goes with the posts:
Number 1:
Network Security Warning ..... How to Protect Yourself On The Internet
I just wanted to warn members that there has been a significant increase in the number of port scans worldwide over the last week or so. And, these port scans are becomming increasingly sophisticated. I am now personally seeing about 25+ attempts per day to compromise my home LAN. So, beware, tighten up your LAN security, buy a good router/firewall (if you don't already have one) with Stateful Packet Inspection, and surf safely. It is getting even more dangerous out there.
Decent router/firewalls with SPI are NOT a big investment. You can find several major brands at places like NewEgg for only about $45. Remember, if you use a broadband connection, you have a LAN whether you think so or not.
One final note. If you are not familar with the consequences of a successful port scan, here they are in a nutshell: If a scanner can get to your system, they can mount your hard drives just as if they were connected to their system. They can read EVERYTHING on your hard drive - every file, all your data, whatever, and when they are finished, they can reformat your hard drives, or otherwise completely hose your system. If you think viruses and trojans are bad, successful scanners are your worst nightmare.
Number 2:
In addition there are a number of sites which test your security, GRC is one. Click on the ShieldsUp link in the middle of the page here:
http://www.grc.com/default.htm
In a prior thread, I posted some general rules to follow when setting up a firewall/router, worth repeating here:
1. Block everything you can at the hardware level before it reaches your system, i.e., at the router.
2. Close everything, all ports, all protocols as default. Open only those ports/protocols that you actually need to have open.
3. Prohibit all inbound connections entirely unless you are running a secure VPN.
4. To protect open ports/protocols, always get a hardware router/firewall that has Stateful Packet Inspection.
5. If your router provides MAC address selection, exclude all MAC addresses except those MAC address actually on your LAN.
6. Do exactly the same with software firewalls, but add to that outbound program control.
7. Limit the NAT address range at the router to only enough internal IP addresses to accomidate the systems on your LAN.
8. If your firwall has a "stealth" setting, use it.
Number 3:
For those unfamilar with SPI, here is a brief, simplistic description.
In order to use the internet, you do have to open some ports and protocols on your firewall router to outbound packets. And, in return, you need to be able to receive return packets back from the internet in order to, say, get your email. That means that there is an open vunerability to attack via those open ports and protocols that can be exploited IF a hacker is sophisticated enough to be able to break through your NAT protections, and there are ones that certainly can do exactly that.
What SPI does is create a "one way door" so to speak. It "remembers" requests that have been made, again say for your email, and will permit entry only for those packets which are being received in response to that request. So, unrequested packets, spoofing say, a response to a request for your email will not be permitted entry, because there was no corresponding outbound request. Thus, it protects necessary open ports and protocols from inbound attacks.
As to the question of WHICH router/firewall, I personally use a commercial grade SonicWALL SOHO, which I have had for a number of years. It isn't inexpensive, that's for sure, but it is a very solid well made absolutely dependable unit. And, at the time I purchased it, just about the only one available within reach of a home/small office user. Today, there are others available
Yesterday, I found a Netgear one at NewEgg for another member looking for exactly this kind of thing. Now, I am NOT playing favorites here, nor have I personally tried the Netgear, but its SPECS are what I would be looking for if I were buying now. Although personally, I would buy another SonicWALL despite its' considerable price. Here is a link for the Netgear at NewEgg:
http://www.newegg.com/app/ViewProduc...122-120&depa=0
Whichever brand is your favorite, fine, go for it. Just look for one with similar specs.
Edit: Please, don't turn this thread into an discussion about brands, there are pleanty of other threads discussing that issue. Get any brand you like, but just get something to protect yourself.
I'll tell you from personal experience. I do ALL my personal accounting on my computer. Years ago, before I knew anything, and still accessing the Internet via dial up, with NO protection at all - I had no idea that was even needed, I had all my personal info stolen by a cracker from Russia. Before I knew it, my accounts were raided, my credit cards compromised, and AMEX taken for over $50K. While I was completely protected by my bank and credit card companies, and lost no money, it took me over a year to get everything straightened out. I learned FAST how to protect myself, and haven't had any problems since, even though there are hundreds of attempts a week to gain access to my LAN.
Reply With Quote
and now you have a sticky thread on this forum 
Bookmarks