Comment

I’m an enterprise guy, so that’s the explanation for non home use things.

VPN for anything not my web or certificate revocation distribution point
Sophos IPS
sophos utm for web application firewall
transparent inline web proxy, sophos is doing https inspection. I have internal CA and all clients trust it. I don’t inspect medical or banking, other common sense stuff.
my windows clients are managed by active directory with heavy handed GPOs.
least priv accounts, different accounts for workstation admin, server, domain, network devices
security Onion IDS
separate red forest that has admin accounts for my management access and accounts on devices
trellix antivirus and global reputation based file monitoring
I’ve started applying disa STIGs on servers
site to site VPN with other family member household. They get managed trellix av also.
my public identity accounts like MS,.Google, etc all need 2fa, token, etc.

I bet this can still get exploited, just would take effort hopefully none does for a home network.

I’m still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.

source

Sort:hotnew top

shadowintheday2@lemmy.world ⁨9⁩ ⁨months⁩ ago
[deleted]
source
- MSgtRedFox@infosec.pub ⁨9⁩ ⁨months⁩ ago
  Also laughing because that’s how some companies get owned, IP stolen, etc.
  
  There has to be balance, if your life using their system sucks so hard you can’t do your job or meet production marks, you get creative.
  
  My industry has to prioritize security over productivity. It’s almost impossible to get work done.
  
  source
  - shadowintheday2@lemmy.world ⁨9⁩ ⁨months⁩ ago
    [deleted]
    source
    MSgtRedFox@infosec.pub ⁨9⁩ ⁨months⁩ ago
    Your working environment sounds gross :)
    
    IT is hard. Finding good IT people is harder in my opinion. Working for a company that is not super squared away with good security and great usability sucks. At least you found some work arounds and are trying to do it well.
    
    source
    -> View More Comments
- MSgtRedFox@infosec.pub ⁨9⁩ ⁨months⁩ ago
  Ha yeah.
  
  Id say the same for trellix.
  
  You should try doing things with installs or updating apps when the edr product blocks write access to all temp locations. You have to do an exclusion for every installer, signing cert, or turn it off to install programs.
  
  source
XTornado@lemmy.ml ⁨9⁩ ⁨months⁩ ago

I’m still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.

As somebody taking like 0% of all that measures and not having any problem, luck was involved for sure, unless they have a good reason to attack you in particular… I feel like you will be fine…

source
- MSgtRedFox@infosec.pub ⁨9⁩ ⁨months⁩ ago
  Ha, probably. It’s fun to learn stuff though.
  
  Working in this field, almost every company has been beached, IP stolen, etc.
  
  Sometimes your home IP gets hit in an automated scan for a vulnerability and then auto exploited by automation. I’m hoping not to get random chance added to a botnet.
  
  source
MigratingtoLemmy@lemmy.world ⁨9⁩ ⁨months⁩ ago
You seem to have a great setup. Since this comment touches on slightly advanced topics, I’ll ask this here:

What use do you have for a WAF?

How did you get your Android clients to trust your certificate? Do you use an MDM? Did you root your devices to access the trusted root store?

Segmenting stuff with VLANs, subnetting and ACLs is a great idea, but do you also make sure that the firmware of the device is somewhat robust? Although I suppose you don’t have to worry about it if Sophos sends out regular updates, however I hate the idea of my switches and routers having to connect to the Internet, pass along credentials and the sort to be able to get updates.

Your measures seem to be focussed more on security than privacy - which is great! It’s my fault for not specifying it in the post, but I’d definitely like to know if you have done anything specific to keep your network private as well as secure.

Thanks for your wonderful comment - saved!
source
- MSgtRedFox@infosec.pub ⁨9⁩ ⁨months⁩ ago
  Exchange on prem 😳
  
  Both mdm,.Ms intune, and just installing the root cert manually in trusted store. You don’t have to root Android for that. It presents some warnings, appropriate.
  
  My Sophos is self contained. It does radius against active directory. It wants IPS and other updates though.
  
  I guess the firmware is as good as possible. All network devices are just computers and can be exploited. I use a Cisco router as my actual gateway. Sophos is inline after that.
  
  Privacy. 🤔
  
  Not much. I have certain traffic go through a VPN to the Internet, but that’s split tunneled.
  
  I use incognito? That doesn’t really do anything, ha.
  
  I’m slowly killing web browser tracking and cookie stuff that group policy allows.
  
  source
  - MigratingtoLemmy@lemmy.world ⁨9⁩ ⁨months⁩ ago
    I didn’t know MS exchange could be used as a WAF. Will need to read more about that.
    
    Can I host Intune completely on-prem?
    
    What do you mean by “My Sophos is self-contained”?
    
    Does your Cisco router get updates? My problem with these companies is that they build backdoors in their firmware for agencies to use. Are you monitoring the network usage of your Cisco gateway?
    
    Using AD/RADIUS on-prem is an intriguing idea. I didn’t consider it because if my AD server goes down I’m essentially locked out of my services. I need to think more on this. Thanks.
    
    source
    MSgtRedFox@infosec.pub ⁨9⁩ ⁨months⁩ ago
    Sorry for confusion. I use Sophos utm as a WAF for exchange. Basically reverse proxy that is specifically programmed for exchange attacks. It allows OWA to keep working.
    
    I put the exchange admin URL behind authentication, so you try to go to /ecp, it Sophos intercepts and make you authenticate to Sophos utm first, which is passing to ad with radius.
    
    MS got rid of intune on prem. It’s only Azure service now. I think.
    
    My router is my biggest vuln. Oddly the most important. It’s an enterprise ISR. It’s updated as far as possible. My paranoia ends with the US gov/NSA. I don’t care if they want back door oddly. I don’t want China using me for attack relay however.
    
    Loads of monitoring. You do a span/mirror port to your IDS like security Onion. Let it analyze all your traffic. Apparently there are some state sponsored exploits that allow them to owe a router at kernel level and hide their activities from you and monitoring, but that’s a level I can’t deal with.
    
    As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.
    
    source
    -> View More Comments