Securing a Server against server vulnerability scanners
Securing a server using a strong firewall
In the past a system administrator could only use a firewall to turn ports on or, which was a very static solution to an increasingly dynamic problem. This also failed other security concerns, especially the fact that firewalls that simply “close” ports still respond to a request telling the requesting party the port is closed. This allows for carefully scripted packets to still call upon services running on those ports. Modern firewalls “stealth” the port, meaning that no response is sent, and any data sent to that port is immediately thrown away. This does not allow for any data to be received on that port whatsoever. Stealthing ports causes any port scans to take much longer so if the attacker is scanning a large number of ports (common to an attack) the scan can take upwards to hours or days depending on the scan technique.
In addition, some newer firewalls also allow for dynamic port opening to only open a port when necessary and leaving it stealthed when unused. This works only for client computers that do not need to listen for requests, however this can be a very good solution for computers behind a larger network firewall.
Securing a server using patches
Regularly visiting the vendor's website for the latest patches is a good way to keep your server secure. Also many vendors provide mailing lists to contact customers whenever a vulnerability has been found. Often these e-mails are provided before a patch can be issued and give the System Administrator instructions on how to minimize the effect of the security hole.
Remove Information in broadcasted headers
Many services will broadcast their name and version number before a user has been authenticated. This happens with many HTTP, FTP, SSH, and telnet clients as well as many others. If the service provides its name and version number to a hacker, he only needs to do a quick search on Google to reveal all the latest vulnerabilities and exploits for that service. Removing broadcasted information in headers is imperative; however it does not mean you don't have to keep up on patches for the server, because the hacker can simply try all the exploits known for that service. This attack will take longer, however it will eventually reveal the vulnerability.
Stay educated
Keep up to date with all the latest security issues by subscribing to the bugtraq, ntbugtraq and other mailing lists. For more information see http://www.securityfocus.com/archive .
| <<Previous | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | Next>> |
Provided by: Security Innovation, The Application Security Company