Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 240
  • Last Modified:

Changing Server Names for Security Reasons.

We recently underwent a security audit, in which it was determined that the naming convention of our servers posed a security threat. Our Proxy server is called Proxy, our File server is called ...._fileserver, etc. According to the audit this is a vulnerability. I am of the opinion, that once a hacker has penetrated your network, the server name is of minor importance, since he / she can determine what the server's purpose is by querying the services that are running on the particular server.

Does the name of the server really play such an important role in network security?

Regards,

JT.
0
GEBE1
Asked:
GEBE1
  • 4
  • 3
  • 2
  • +1
1 Solution
 
EricCommented:
In my personal opnion.  no it doesn't.   where i work, we use location names as the server names (ie  cleveland-1, cleveland-2, cleveland-3, etc...), however, in the description of the computer, we tell what it is used for (file server, remote desktop, etc.).  i'd say once a hacker has gotten into the network, he's going to already know where he is going if he's not already there.  a cryptic name might confuse a hacker at the beginning, and they eventually might get into it, but how much trouble will it cause for the legit people in the network..

just my 2 cents

0
 
GEBE1Author Commented:
Thanks for the feedback egiblock.

JT
0
 
EricCommented:
no problem.  

on another note.   (i heavent done it) but have heard from people that changing server names once established in a domain is a pain in the but...  it could be changed now, but i know it was a pain back in the nt4 days..
0
The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

 
jburgaardCommented:
Try look at this from dif. point of view':

First of all,try to put yourself in the shoes of the culprit.
Perhaps you would not like to get caught in the act.
Perhaps breaking in to the network would be quicker and leaving less clues if you knew something about the servers.

The people making security audit :
perhaps they had a hard time finding what you would consid. real issues,
the time spent m. be +/- the same with/without 'real' trouble.

The management
having spent a lot of ress's on security audit, would be regretfull, IF at some time a break SHOULD show up, if they did not do what security audit had mentioned best pracice.

I guess you
wonder what issues can imege from playing with all names.

0
 
GEBE1Author Commented:
Also valid points, but I would spend more time and money trying to strengthen my firewall, so that the chance of a break would become as small as possible.
0
 
jburgaardCommented:
Probably a good idea.
My personal feeling is :
-When starting on a fresh, then give the servers 'secure' names.
-When you have got things working, do not mess
0
 
jpdaveyCommented:
I'm with egiblock. A simple port scan through the network will tell the hacker what he wants to know. I've got one network set up with the obscure names and another with the function names. The obscure names only confuse the network admins and helpdesk guys that aren't always working on that network. Everyone can figure out what server "fileserver" does.
0
 
GEBE1Author Commented:
Being that I fall under the network admins group I tend to side with egiblock and jpdavey. Is there documentation that describes best practices iconcerning this?

JT.
0
 
jburgaardCommented:
>it's dependant on the network's security requirements and what YOU're comfortable with< from
http://www.experts-exchange.com/Security/Q_21513099.html
0
 
GEBE1Author Commented:
I appreciate everyones input, I guess this is more a matter of opinion than procedure.

Regards,

JT
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 4
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now