Welcome to ISAserver.org

Zotob Protection from ISA

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 General ] >> General >> Zotob Protection from ISA

Page: [1]

Message

<< Older Topic Newer Topic >>

Zotob Protection from ISA - 20.Aug.2005 10:59:00 AM

topcat247

Posts: 2
Joined: 20.Aug.2005
From: Annapolis, MD
Status: offline

I was recently sent an advisory indicating which ports to block to provide protection from the Zotob worm. Other steps were also mentioned which I will not go into here.

My question: Doesn't the apllication-layer filtering in ISA Server provide zero-day protection from worms like Zotob? Assuming ISA can provide this protection, 1) how do you configure ISA to get this protection and 2) what is it about the behavior of Zotob and it's variants that is blocked by ISA?

Thanks,
TC

Post #: 1

Featured Links*

RE: Zotob Protection from ISA - 20.Aug.2005 11:03:00 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi TC,

Check out the information on this on my blog at http://spaces.msn.com/members/drisa/

Here's the specific link:
http://spaces.msn.com/members/drisa/Blog/cns!1p9yz6owxXl-uIlyqIZXkCrg!138.entry

HTH,
Tom

[ August 20, 2005, 11:05 AM: Message edited by: tshinder ]

(in reply to topcat247)

Post #: 2

RE: Zotob Protection from ISA - 20.Aug.2005 2:30:00 PM

topcat247

Posts: 2
Joined: 20.Aug.2005
From: Annapolis, MD
Status: offline

Tom,

The link you provide references the notice I mention in my original post. This notice recommends blocking ports to block the threat. Couldn't any L3/L4 firewall do this? What unique protection does ISA provide?

Thanks,
TC

(in reply to topcat247)

Post #: 3