Discussion
Bit of a problem that maybe someone here might have a thought on...
I need to allow the XP machine access to our internal network but am a bit worried about the security implications.
Will setting the DNS to manual and pointing it to our router mean that the machine is fairly safe from attack from the outside?
I need to allow the XP machine access to our internal network but am a bit worried about the security implications.
Will setting the DNS to manual and pointing it to our router mean that the machine is fairly safe from attack from the outside?
I don't know where you are or any of the background, but here's how I'd play it.
Firstly I'd say no. There's no way I'd let XP machines on the network.
If I really had to, I'd use our firewall to create a DMZ for those machines on a separate physical connection on the firewall, ie. so all traffic has to go through the firewall whether it wants to or not.
Then depending on what they needed access to (and the security implications on a per service basis) I'd allow ports as needed to the local network, and specifically to server/device needed.
You could use something like a Sonicwall Soho 250 or TZ350 if your budget was low. Other firewalls do exist.
That said your budget may be less, and your environment such you don't mind the risk. It's really horses for courses.
Firstly I'd say no. There's no way I'd let XP machines on the network.
If I really had to, I'd use our firewall to create a DMZ for those machines on a separate physical connection on the firewall, ie. so all traffic has to go through the firewall whether it wants to or not.
Then depending on what they needed access to (and the security implications on a per service basis) I'd allow ports as needed to the local network, and specifically to server/device needed.
You could use something like a Sonicwall Soho 250 or TZ350 if your budget was low. Other firewalls do exist.
That said your budget may be less, and your environment such you don't mind the risk. It's really horses for courses.
If it's a flat network structure, the simple solution would be to remove the default route / gateway.
That would prevent the XP machine from accessing anything other than the local LAN.
Of course you'd need to provide local DNS servers to enable it to find local servers - or - leave the DNS server fields empty and use a hosts file.
That will be safe enough.
Edited to add:
I would also disable the network sharing on the XP machine so that nothing is able to connect to it.
That would prevent the XP machine from accessing anything other than the local LAN.
Of course you'd need to provide local DNS servers to enable it to find local servers - or - leave the DNS server fields empty and use a hosts file.
That will be safe enough.
Edited to add:
I would also disable the network sharing on the XP machine so that nothing is able to connect to it.
Edited by TonyRPH on Wednesday 19th February 13:30
phil4 said:
I don't know where you are or any of the background, but here's how I'd play it.
Firstly I'd say no. There's no way I'd let XP machines on the network.
If I really had to, I'd use our firewall to create a DMZ for those machines on a separate physical connection on the firewall, ie. so all traffic has to go through the firewall whether it wants to or not.
Then depending on what they needed access to (and the security implications on a per service basis) I'd allow ports as needed to the local network, and specifically to server/device needed.
You could use something like a Sonicwall Soho 250 or TZ350 if your budget was low. Other firewalls do exist.
That said your budget may be less, and your environment such you don't mind the risk. It's really horses for courses.
Tbh I am worried about having a gaping target sat there saying come in I am open. The computer is not used for anything other than producing production information, so it is not used to surf the web or open emails or anything like that. Firstly I'd say no. There's no way I'd let XP machines on the network.
If I really had to, I'd use our firewall to create a DMZ for those machines on a separate physical connection on the firewall, ie. so all traffic has to go through the firewall whether it wants to or not.
Then depending on what they needed access to (and the security implications on a per service basis) I'd allow ports as needed to the local network, and specifically to server/device needed.
You could use something like a Sonicwall Soho 250 or TZ350 if your budget was low. Other firewalls do exist.
That said your budget may be less, and your environment such you don't mind the risk. It's really horses for courses.
We use a Sonicwall (no idea what model.) Our hardware/ IT company admin it.
Will get their opinion on what to do.
I was just hoping my DNS re-route would be an easy fix
nikaiyo2 said:
Tbh I am worried about having a gaping target sat there saying come in I am open. The computer is not used for anything other than producing production information, so it is not used to surf the web or open emails or anything like that.
We use a Sonicwall (no idea what model.) Our hardware/ IT company admin it.
Will get their opinion on what to do.
I was just hoping my DNS re-route would be an easy fix
In which case you can as well as separating them from your LAN and controlling access to it, you can also stop them accessing and being accessed from the WAN (aka Internet).We use a Sonicwall (no idea what model.) Our hardware/ IT company admin it.
Will get their opinion on what to do.
I was just hoping my DNS re-route would be an easy fix
Each zone can control traffic between it and other zones (eg. LAN, DMZ, WAN), either way.
I'd definitely talk to your support people as they should be able to set it up for you and should be safer than quick fixes. Your DNS idea while good relies on it "stopping a problem in the normal course of events", whereas malware and the like isn't normal, and may easily find a way around.
anonymous said:
[redacted]
The option is to buy a new control system for the machine... it can only come via the manufacturer as it has to have their software on it, so they can charge what they want... £30k.This basically gives a new PC and touch screen, it does not improve productivity or offer any improved functionality over the old software. (We also run a new version of the machine, the old one is a back up/ overflow)
nikaiyo2 said:
It picks up data "live" from one location and converts it to the file type needed for this machine.
The data is constantly changing with no or very little repetition, but it is updated constantly.
Did you see my post above? About not setting a default route etc?The data is constantly changing with no or very little repetition, but it is updated constantly.
It would solve your problem.
TonyRPH said:
Did you see my post above? About not setting a default route etc?
It would solve your problem.
Hi TonyIt would solve your problem.
Thanks, yes it was kind of what i was planing... but I think I will let our support people come up with solution. Mainly because i don't want to do a "quick and easy" fix and it come back on me when it screws up.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff