Re:Port knocking
by perlgeek on Friday May 15, 2020 @07:45AM
(#23191035)
> modern networks are built with short-lived certificates issued off 2FA from an IdP
Modern networks are sadly far too rare; 95%+ of the industry is built on legacy networks.
My take on fail2ban and port knocking are:
* they reduce the amounts of logs produced
* they defend against fully automated at-scale scans / password stuffing attacks that a well-maintained application wouldn't need defending against, but we all know that in any sufficiently big organization, not all applications and accounts will be well maintained.
Modern networks are sadly far too rare; 95%+ of the industry is built on legacy networks.
My take on fail2ban and port knocking are:
* they reduce the amounts of logs produced
* they defend against fully automated at-scale scans / password stuffing attacks that a well-maintained application wouldn't need defending against, but we all know that in any sufficiently big organization, not all applications and accounts will be well maintained.