• 0 Posts
  • 4 Comments
Joined 1 year ago
cake
Cake day: October 29th, 2023

help-circle

    1. Snort on perimeter inbound and outbound.
    2. ntopng on perimeter.
    3. Heavy VLAN segmentation. Like with like.
    4. Inter-VLAN ACLs on core switch. This is a stateless firewall. Some VLANs with certain device types have inbound and outbound. Trusted devices only have inbound.
    5. SPAN to Security Onion for all internal traffic.
    6. SNMPv3 monitoring on all devices.
    7. MAC Sticky on all camera ports because the cabling extends outside of the physical structure of the house. I am going to implement Dot1X at some point.
    8. VRFs for sensitive infrastructure to prevent outbound routing completely.
    9. A VRF for devices to be forced through an external VPN (Mullvad). Used for devices that do not support a VPN agent.
    10. No antivirus. All antivirus is a botnet.
    11. All server infrastructure is Devuan using OpenRC instead of systemd.
    12. Gaming PC is Artix.
    13. DNS blackhole.
    14. Public DNS is a Swiss no-logging provider which I use DoT to send my queries to.
    15. LibreWolf or Brave Browser on everything.
    16. Only hole into the network is a 4096 bit encrypted Wireguard instance operating in a container using an uncommon port. I wrote a custom script that can reach into the container and pull from the API in order to show active sessions, GeoIP, browser fingerprints, length of time the socket has been open, etc.
    17. I use geofencing for inbound connections to the Wireguard instance. I only allow my immediate area cellular ISPs IANA address spaces to touch my network. Same goes for the geographic area surrounding my parents house.
    18. Unattended updates using custom scripting for my servers, including rebuilding the Wireguard container every single night, updating the server, and I also fire Nessus at it every night. If in the morning there is a CVE of note on that server, the NAT rule allowing traffic to the VPN is disabled at the perimeter until a sufficient patch is released.
    19. I run STIGs on everything, within reason and where infrastructure allows, in my suite.
    20. LibreSSL over OpenSSL.