exposing ones dns on the internet

Zaf,

Thanks for your very good response. I learned something from it.

Dalton

With exception based security you only open access to the ports that are used. This is by FAR your best first step to securing a DMZ. If you only are serving port 21, 80 and 443 for instance, only requests on those ports will go through to the set DMZ server. This keeps a hacker from doing a port 389 (LDAP) based attack for instance.

Change your MAC address on your firewall if you can as well. The first part of your default MAC address is the manufacturer of your NIC - which is normally the manufacturer of your firewall. This now tells the hacker what type of protection you are using and makes an attack strategy easier. Set it to something not in use and reveal nothing to the enemy. (con't next msg)

Now is where I actually answer your question!

With this basic security in place now you are most vulnerable to attacks on the specific ports that are still exposed but are used to serve legitimate public side information.

New vulnerabilities surface all the time, so there is no way to ensure air tight security here - that's just reality.

Keeping your patches up to date on both the server OS and the application serving the data (which is too often overlooked!) is a key first step. Shutting down unused services is also very important and often overlooked. This process is a basic server "hardening". Microsoft has an internal security scanning utility you can use to check your servers for known vulnerabilities.

The best scanning tool suite I've seen is by Eeye digital solutions. They have the entire gambit of products to handle security scans and IDS from all sides. But it is also incredibly expensive.

SonicWALL used to have it if you made an account even without a registered product you got a free scan using their scanning utility. It's pretty good and gives you a very nice report afterwards. Even if you have to pay for it - it's a good tool.

Commercially there is about 1001 companies that are more than happy to run scans on your WAN IP range - but lots of them don't do much for the big bucks they can charge. If you have the time and Linux background Snort is the best scanning and intrusion detection system there is. It's free and has just tons of add ons that other people have developed. Just remember that lots of the add-ons are privately developed and there is always a risk they also have a darker motivation to get you to run them...

*whew* I could literally talk all day about this, but I am a security specialist! In a way because there is no "silver bullet" is why I am employed in this position. But if you follow the above steps and run an independant scan or two you will be better off than 99% of the public servers out there (trust me on this one!). At least this makes you unattractive to most hackers who are looking for easy prey (the low hanging fruit thing).

Antivirus on your server probably goes without saying...

And of course a good firewall is worth it's weight in gold, especially if it does deep packet inspection - but it should at least do stateful packet inspection.

http://www.microsoft.com/technet/security/tools/default.mspx

Link for Microsoft security tools

Also www.mysonicwall.com will make you an account (not sure if the one scan is still free).

http://www.snort.org/
Snort is the best tool out there that I know of. It's used by both security and hackers ; )

http://www.packetstormsecurity.org/
Packetstorm is a great place where security minds gather. It has good white papers and discussions. Always a good bookmark to have.

Zaf

Reading this over I see that I say that Snort and Eeye are both the best tools I know of; let me clarify this!

I would recommend Eeye if you can afford it, but Snort is next in line and is certainly affordable as it is free!

Zaf

Thanks for the positive feedback. If anyone has some questions just post a comment I'll see if I can help.

Zaf

i was looking for more. see hacking revealed.