RE: RMTCMD's security?

John,

Answers such as yours amaze me. Isn't part of securing a "target" system ensuring it cannot be used as a leaping point to other systems at which point once compromised becomes a host system?

Gary Monnier


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of John Jones
Sent: Thursday, May 17, 2012 12:19 PM
To: Midrange Systems Technical Discussion
Subject: Re: RMTCMD's security?

Secure the machine(s)/hosts that will be the target of the remote commands.

Securing the endpoint machines machines that will send the command is near meaningless. All it takes is a rogue device on the network or a compromised Internet-facing host and secure endpoints won't mean squat.

On Thu, May 17, 2012 at 2:12 PM, Monnier, Gary <Gary.Monnier@xxxxxxxxx>wrote:

Scott,

By "to" machine do you mean the target system or the host system?

Gary Monnier


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:
midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Scott Klement
Sent: Thursday, May 17, 2012 11:12 AM
To: Midrange Systems Technical Discussion
Subject: Re: RMTCMD's security?

You should always secure the "to" machine. Securing the "from"
machine isn't even worthy of being called "security".

On 5/17/2012 11:27 AM, rob@xxxxxxxxx wrote:

Should you be securing the "from" machine (ie the system they
initiate the remote command from), or should you be securing the "to" machine?

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

--
John Jones, CISSP
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.