Quote Originally Posted by Cider View Post
Hi there,

I am very intrigued by this comment/s of yours. Please explain to me in detail how the hell you are protecting your company with no AV packages running? Running exchange 2007 I presume. Please explain.
WOW Now that's a request!

First off read the link MLF provided.

Second, I use CISCO products not ISA so there is a difference there.

Third MXLogic

Fourth Websense

Now I must say that I only patch things that I allow on my network. I DO NOT RANDOMLY PATCH EVERYTHING THAT COMES DOWN THE PIPE! Make that your #1 rule

I do not allow IMCP in or out of the network unless it's port 25. Which means I can't even do a tracert to you from my workstation (USE DNSSTUFF instead)

I deny all but email traffic. 80 and 8080 are on a seperate vlan Many CiOS rules there.

NO ONE has admin or power user rights. Many AD policies modified so users can still configure their bells and whistles.

If MXLogic is down or unavaliable, I do not recieve any email

If web sense is down NO INTERNET ACCESS for anyone

All end point devices (even remote users) must use MY equipment, and MY gateway. Again AD rules.

No bootable USB devices. Only administrators can boot from CD

Only the one mail server has a gateway. THERE ARE NO INTERNET GATEWAYS on my servers. Servers are locked with a domain account. And in a secure data center.

Layer 3 SNMP traps and mac filtering enterprise wide

The bottom line theroy is do all your scanning - filtering either off the network or on the other side of the gateway.

End point security and layer 3 threats are #1.

Don't allow remote access ssl or rdp to a server unless you are 100% sure security is set correctly. If remote control is not needed, uninstall the service. DO NOT DISABLE uninstall. A service or program cannot be exploited if it is not installed.

Research windows 2008 and M$ Virtual server.


DO NOT INSTALL VISTA ANYWHERE ON YOUR NETWORK

That's just the tip of the ice burg.