Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Is it time to block all Microsoft protocols in the core?

  • From: alex
  • Date: Mon Jan 27 14:20:02 2003

> > I don't think it's so much of a problem of programs opening listen
> > sockets as it is a problem of admins not properly controlling their
> > networks and a certain software company pushing insecure features like
> > printing over the internet that refuse to work from behind a firewall
> > and have no direct proxy support.
> >
> >
> This is the exact reason why any arguments to management to block NETBIOS
> have failed. The reasons it is rejected are always the same:
> 
> a) We're not responsible for our users getting infected through their own
> ignorance
> b) Some of our users refuse to use VPN or lack the knowledge to effectively
> use it and want to use NETBIOS services over the Internet

There are two different things that you are grouping together, when in fact
they are separate. As an ISP, you have two networks. The first one of them
is your internal network on which you may have MSSQL server or any other
servers used by your company.  The second network is the network to which
you connect your customers. These two networks have two distinctly different
security policies. I will venture as far as to say that you probably are
filtering what comes in and what comes out of your internal network. On the
other hand, you are proving IP transit to the customers. Filtering randon
ports on the second network baffles me. Why would you do it? Dont you bill
people for the traffic that they receive/get? Obviously, should your
customer be attacked, you want to participate in coordination of the
response, however, it is a job of your customer to decide if they want to
filter some ports from their network or if they want to contract you to do
that for them.


Alex





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.