On Fri, Jun 22, 2012 at 02:30:01PM PDT, Dave Kleiman spake thusly:
> I know I have seen a plethora of 3389 automated scans and upon successful
> connection, attempted password attacks, what would happen if I changed to
> some other port?

Why isn't there a firewall restricting who can connect to your db server?

Why aren't you requiring something better than just password auth?

You change the default port but you don't implement these far more effective
controls?

> Sometimes security through obscurity does work. I am certainly not
> suggesting it would protect you from an Advanced Persistent Threat, but every
> little layer of security affords a little protection, deterrence, or delay.

It sets a bad precedent and doesn't scale when you have to worry about changing
the default ports on a bunch of database servers and apps. Many "little layers
of security" just aren't worth it.

--
Tracy Reed
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFP5OmOBhSTPg0d/nQRAvPcAJ9DHAcRNnHucTz7IpE488Xzp3ifJACgiXLh
SVFWH3L55rHg0ab6Sl4j5U0=
=5DXx
-----END PGP SIGNATURE-----

[ reply ]