Comment by zokier | Hacker News Reader

Comment by zokier | Hacker News Reader

Parent Full thread

> Set up a guest network to enable internet connection for your guests and for your IoT devices.

I would definitely recommend separating guest and iot networks, iot is usually pretty weak (the S in IoT stands for security) so they need as much protection as possible; putting them to guest network is throwing them to wolves.

> Enable port filtering. For example, the SANS Institute recommends blocking outbound traffic

Tbh egress filtering is generally not very useful, except for some special case networks (like aforementioned iot network). Blocking IRC seems just silly.

> Use Media Access Control (MAC) filtering to choose which trusted devices connect to your network.

Afaik MAC filtering is pretty much useless, MAC is easily snooped and spoofed. WPA should be sufficient access control, go for EAP ("Enterprise") if you need better than PSK ("Personal") security.

> Disable remote access management

Realistically, not going to happen. Better advice would be to have separate management network, with tighter access controls.

Ky feelings on egress port blocking have been one of the big changes in cyber security over the years, and I think a lot of best practise guides will take years to catch up.

At one point you could restrict egress to certain ports and be reasonably confident in what was going on on a network. These days basically everything is tunnelled over port 443, including most malware communication.

And big part why everything is going through 443 is because of overzealous netadmins blocking everything else.

And then you have applications like Skype that need all ports: https://support.microsoft.com/en-us/skype/which-ports-need-t...

Blocking IRC can be sensible.

Some botnets use IRC for command and control.

If you’re not using IRC yourself anyway, then you might as well block it. And let’s face it, most people don’t use IRC anymore. They’ll be using Discord instead.

Still makes me sad, that a private company's chat platform is a commonly used comms/support platform.

> Tbh egress filtering is generally not very useful

i found it sensible to log-drop non-internet traffic (rfc1918, linklocal ...) on internet-facing egress

> (the S in IoT stands for security)

Yoinking that for later...

> > (the S in IoT stands for security)

> Yoinking that for later...

Same. It took a couple seconds to proc that statement wasn't some kind of unique misprint or accidental slip up. Same thing happened when i first got a summary of IoT security in general.

Reply on news.ycombinator.com