Improving Web Application Security: Threats and - CGISecurity

678 Part V: Assessing Your SecurityRouterUse the following questions to review your router configuration:● Have you applied the latest patches and updates?Check with the networking hardware manufacturer to ensure you have the latestpatches.● Do you use Ingress and Egress filtering?For more information, see “Network Ingress Filtering: Defeating Denial of ServiceAttacks which employ IP Source Address Spoofing,” at http://www.rfc-editor.org/rfc/rfc2267.txt.● Do you block ICMP traffic?Make sure you block Internet Control Message Protocol (ICMP) traffic at the outerperimeter router to prevent attacks such as cascading ping floods and otherpotential ICMP vulnerabilities.● Do you prevent time-to-live (TTL) expired messages with values of 0 or 1?This prevents information disclosure caused by route tracing.● Do you receive or forward broadcast traffic?Source addresses that should be filtered are shown in Table 22.1.Table 22.1 Source Addresses that Should Be FilteredSource AddressDescription0.0.0.0/8 Historical broadcast10.0.0.0/8 RFC 1918 private network127.0.0.0/8 Loopback169.254.0.0/16 Link local networks172.16.0.0/12 RFC 1918 private network192.0.2.0/24 TEST-NET192.168.0.0/16 RFC 1918 private network224.0.0.0/4 Class D multicast240.0.0.0/5 Class E reserved248.0.0.0/5 Unallocated255.255.255.255/32 Broadcast●Have you disabled unused interfaces?Make sure that only the required interfaces are enabled on the router.