It\'s become standard fare for security minded organisations to block everything

Question

It's become standard fare for security minded organisations to block everything other than 80 and 443. As a result, more and more applications (other than web browsers) are learning to use these ports for their needs too.

Naturally malicious programs do that too, which then means that to have any real security, firewalls have to actually examine the data stream and block based on application data instead of just ports...

This seems to indicate that port based blocking was a short sighted approach to begin with, kind of like input validation solely on client...

In that case, should we not stop blanket blocking nonstandard ports, and go for more fine grained filtering in the first place...? Or are there other reasons to keep the port-whitelist approach?

Explanation / Answer

You're absolutely correct. There's nothing magical about port 80, or port 443. There's nothing inherently secure about one port or another, or even one protocol or another. If you block everything but HTTP, everyone will simply start using HTTP. The attackers can and do always move faster than everything else. They aren't limited by maintaining old infrastructure.

In essence, protocols and ports aren't secure or insecure. Blocking them is just another form of security theatre.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.