Fail2ban on load balancer
-
@scottalanmiller said in Fail2ban on load balancer:
@wrx7m So the real question for geo-blocking is...
Pro: Blocks attacks from script kiddies and other annoying but essentially non-threatening entities.
Con: Blocks a small number of potential customers, likely causing them to not do business with you (because they don't know that they can.)So put a dollar value on each, or ask your CFO/CEO to do so. How much is the value of the annoyance versus how much is the value of the lost revenue?
Both numbers are small. For me, I can't even imagine the second number, it's got to be tiny, but I can't estimate it. The first number I can estimate, approaching zero. Script kiddie attacks, those that can't change their IPs and aren't targeted, don't pose a real threat. They use a trivial amount of bandwidth, fill up some logs, but that's it. They don't impact me. So while I can't put a number of the "con", I know that there is one even if it is $5. But I can put a value on the "pro", and it is essentially zero. So for me, that's a crystal clear "don't take this risk without another factor" answer.
I agree with @scottalanmiller that it is hard to take someone as a serious threat when they don't even bother to change their IP address. On the flip side, it is something that IT management generally expects for whatever reason. I think a big part of comes down to the due diligence factor. It is easy for a CEO to say yeah we block China and Russia as part of our security. It sounds good on a high level which is where IT management lives.
I can see the requirement from their point of view, though. If you are breached and by chance it happens to be from a Russian IP, what is the first thing any security firm is going to ask. Why weren't you blocking IPs from high risk locations? In this case, I think for IT management it is has value. Losing .001% of sales will likely never be noticed and definitely not something where the IT team will receive credit.
-
@IRJ said in Fail2ban on load balancer:
@scottalanmiller said in Fail2ban on load balancer:
@wrx7m So the real question for geo-blocking is...
Pro: Blocks attacks from script kiddies and other annoying but essentially non-threatening entities.
Con: Blocks a small number of potential customers, likely causing them to not do business with you (because they don't know that they can.)So put a dollar value on each, or ask your CFO/CEO to do so. How much is the value of the annoyance versus how much is the value of the lost revenue?
Both numbers are small. For me, I can't even imagine the second number, it's got to be tiny, but I can't estimate it. The first number I can estimate, approaching zero. Script kiddie attacks, those that can't change their IPs and aren't targeted, don't pose a real threat. They use a trivial amount of bandwidth, fill up some logs, but that's it. They don't impact me. So while I can't put a number of the "con", I know that there is one even if it is $5. But I can put a value on the "pro", and it is essentially zero. So for me, that's a crystal clear "don't take this risk without another factor" answer.
I can see the requirement from their point of view, though. If you are breached and by chance it happens to be from a Russian IP, what is the first thing any security firm is going to ask. Why weren't you blocking IPs from high risk locations?
Its become a CYA product and that's about it.
-
@IRJ said in Fail2ban on load balancer:
@wirestyle22 said in Fail2ban on load balancer:
@IRJ said in Fail2ban on load balancer:
@wirestyle22 said in Fail2ban on load balancer:
@wrx7m False positives too. If I blocked all Canada traffic as an example, LogMeIn will intermittently not work because they have data centers in Canada. There is essentially no benefit to it and a few, mostly small downsides. It just aids sale because it sounds cool.
That's not what's being talked about here. We are talking about doing in on a load balancer for a specific service. In this case https traffic to a specific application.
I was talking specifically about potential problems with geo-location. I understand what is being discussed
If you do geo-blocking then it becomes part of the process of installing new software and services to add a whitelist of IPs for that service. Any cloud hosting provider has something similar to this.
https://help.logmein.com/articles/en_US/FAQ/Whitelisting-and-LogMeIn
For what real benefit though? That is kind of my point. It's a PITA but also doesn't benefit you really
-
@wirestyle22 said in Fail2ban on load balancer:
@wrx7m False positives too. If I blocked all Canada traffic as an example, LogMeIn will intermittently not work because they have data centers in Canada. There is essentially no benefit to it and a few, mostly small downsides. It just aids sale because it sounds cool.
That's not false positive, that's intentionally blocking those services. If they are really in Canada, geo-blocking Canada is because you don't want those services, no matter how "legit" they are.
-
@IRJ said in Fail2ban on load balancer:
@wirestyle22 said in Fail2ban on load balancer:
@IRJ said in Fail2ban on load balancer:
@wirestyle22 said in Fail2ban on load balancer:
@wrx7m False positives too. If I blocked all Canada traffic as an example, LogMeIn will intermittently not work because they have data centers in Canada. There is essentially no benefit to it and a few, mostly small downsides. It just aids sale because it sounds cool.
That's not what's being talked about here. We are talking about doing in on a load balancer for a specific service. In this case https traffic to a specific application.
I was talking specifically about potential problems with geo-location. I understand what is being discussed
If you do geo-blocking then it becomes part of the process of installing new software and services to add a whitelist of IPs for that service. Any cloud hosting provider has something similar to this.
https://help.logmein.com/articles/en_US/FAQ/Whitelisting-and-LogMeIn
In that case, and I know there are places where the middle ground could make sense, does it make sense to geo-block but leave the main attack networks open? Rather than just block universally, and whitelist only what is wanted?
-
@IRJ said in Fail2ban on load balancer:
On the flip side, it is something that IT management generally expects for whatever reason.
It's something random non-technical people sometimes given power over IT want for some reason. Not people looking out for security, IT, or business interests, generally. It's the people who are trying to "do something to look like they are doing their job in meetings".
-
@IRJ said in Fail2ban on load balancer:
It sounds good on a high level which is where IT management lives.
Only in bad companies / gov't. No healthy IT works that way. No, granted, the majority of any field is absolute crap.
-
@IRJ said in Fail2ban on load balancer:
Losing .001% of sales will likely never be noticed and definitely not something where the IT team will receive credit.
This technique is also used by social engineers... the problem with lost sales is that they are never noticed. Silently turning away customers is almost always safe, and often IT management will throw away sometimes big numbers of sales (or similar) because it is impossible to detect. They do it because they are lazy, or sometimes malicious.
At one F500 I was at, HR was doing this... turning away candidates before they recorded them in the system, so the company management had no idea that most job candidates were being told not to apply before we even stored their resumes! What seems like it would have been a tiny number turned out to be the majority and it crippled hiring practices.
Not that geo-blocking will ever hit 50%, but it might be numbers far higher than people will guess, and there is no way to ever know. It's always a mystery.
-
@pmoncho said in Fail2ban on load balancer:
@IRJ said in Fail2ban on load balancer:
@scottalanmiller said in Fail2ban on load balancer:
@wrx7m So the real question for geo-blocking is...
Pro: Blocks attacks from script kiddies and other annoying but essentially non-threatening entities.
Con: Blocks a small number of potential customers, likely causing them to not do business with you (because they don't know that they can.)So put a dollar value on each, or ask your CFO/CEO to do so. How much is the value of the annoyance versus how much is the value of the lost revenue?
Both numbers are small. For me, I can't even imagine the second number, it's got to be tiny, but I can't estimate it. The first number I can estimate, approaching zero. Script kiddie attacks, those that can't change their IPs and aren't targeted, don't pose a real threat. They use a trivial amount of bandwidth, fill up some logs, but that's it. They don't impact me. So while I can't put a number of the "con", I know that there is one even if it is $5. But I can put a value on the "pro", and it is essentially zero. So for me, that's a crystal clear "don't take this risk without another factor" answer.
I can see the requirement from their point of view, though. If you are breached and by chance it happens to be from a Russian IP, what is the first thing any security firm is going to ask. Why weren't you blocking IPs from high risk locations?
Its become a CYA product and that's about it.
Problem is, it covers your ass to clueless management. But it exposes your ass to finance, marketing, etc. If someone who really has a clue goes to the business and says that you might have thrown away customers because you don't like people who live in, work from, or are detected as being in certain countries... that could be some big expose. So it's not a standard CYA where you do it to be safe, it's a "pick one CYA or the other." In any company I've worked in, it would be the opposite, you'd avoid geo-blocking to CYA. In banking, as a big example, it would violate SEC regulations as it is illegal to block communications channels in that way (assuming you did it universally) for trading purposes. I've seen people do it accidentally and be told that they had minutes to reverse it before looking at jail time. That's a dramatic example, but shows that even government regulations can make avoiding geo-blocking a CYA exercise in many cases.
-
@wirestyle22 said in Fail2ban on load balancer:
@IRJ said in Fail2ban on load balancer:
@wirestyle22 said in Fail2ban on load balancer:
@IRJ said in Fail2ban on load balancer:
@wirestyle22 said in Fail2ban on load balancer:
@wrx7m False positives too. If I blocked all Canada traffic as an example, LogMeIn will intermittently not work because they have data centers in Canada. There is essentially no benefit to it and a few, mostly small downsides. It just aids sale because it sounds cool.
That's not what's being talked about here. We are talking about doing in on a load balancer for a specific service. In this case https traffic to a specific application.
I was talking specifically about potential problems with geo-location. I understand what is being discussed
If you do geo-blocking then it becomes part of the process of installing new software and services to add a whitelist of IPs for that service. Any cloud hosting provider has something similar to this.
https://help.logmein.com/articles/en_US/FAQ/Whitelisting-and-LogMeIn
For what real benefit though? That is kind of my point. It's a PITA but also doesn't benefit you really
The point is, it's about politics. The value has nothing to do with IT when it does have value. Any (or essentially any) value comes from unhealthy organizations driven by politics and not by results. Which, as I've said many times, is the average company.
