Re: [tlug] Ping vs www server

["Josh Glover" <jmglov@example.com>]

On 18/04/2008, Edward Middleton <emiddleton@example.com> wrote:

>  I am advocating the network security administrators look at the cost to the
> company as a whole of implementing and ongoing cost resulting from security
> measures, and balance that with the improved security achieved.

Yes, this is good advice, and I do not disagree at all. I am just
saying that I have done this calculation several times, and it usually
works out in favour of dropping ICMP at the gateway (and for my
personal machines, dropping it inbound).

>  Death by a thousand small cuts.  The reason for not doing this is that it
> adds unnecessary complexity to your configuration for minuscule improvement
> in security.

If you cannot easily deploy whatever configuration you choose to all
of your network hardware, you have bigger security concerns then
whether to drop ICMP.

-- 
Cheers,
Josh