Nick (@nick@shore.me.uk)

1 ★ 0 ↺

Nick » 2025-10-26 / 2025-10-26
@nick@shore.me.uk

@neil@mastodon.neilzone.co.uk egress rules on your firewall so it can only go where it is supposed to go. Also consider which machines on the inside of your network can get to management of things on your lan or DMZ, often people just trust the whole lan, and ignore this attack vector.

...

Neil Brown » 2025-10-26
@neil@mastodon.neilzone.co.uk

@nick Yep, I have egress rules (and ingress rules), and everything is VLAN'd according to what it does. But that doesn't solve the problem here.

...

greem » 2025-10-26
@greem@cyberplace.social

@neil @nick I can't speak entirely accurately here as I didn't do the arguing with the assessors, but at work we had the argument accepted that FOSS packages which had active maintenance and were actively updated in response to reported security issues had a "vendor". This covered both the OS (at the time CentOS before RH/IBM blew it up as an Enterprise option, now Oracle Linux) and external packages or locally compiled FOSS packages like Exim.

We also have a CE+ network but that's separate.

...

greem » 2025-10-26
@greem@cyberplace.social

@neil @nick For updates, we apply package updates every two weeks or immediately (after assessment of risk) for critical/security updates. That also satisfied the assessors.

I understand that the people doing the assessments can have different opinions but pragmatism seemed to be very much the order of the day for us.

Neil Brown » 2025-10-26
@neil@mastodon.neilzone.co.uk

@greem @nick That is really helpful. Thank you.

...

ninkosan » 2025-10-26
@ninkosan@mas.to

@neil @greem @nick Similar experiences to the above btw from both CE and CE+ - and we use a lot of Debian and FOSS, much of which was in scope. Experience suggests as long as you can point to the fact you’re doing sensible things it’s fine. It’s not ISO 9001!