A company is concerned about potential enumeration of their internal network services by attackers who might gain a foothold on an internal machine. Specifically, they want to prevent an attacker from easily determining which services are running on non-standard ports or identifying detailed version information. Which countermeasure would be most effective in making service enumeration more difficult?
- ADeploying an Intrusion Prevention System (IPS) at the network perimeter.
- BImplementing network segmentation to isolate critical services.
- CRemoving or changing default banners for network services.
- DEnsuring all servers run the latest operating system patches.
Show answer & explanationAnswer & explanation
Correct answer: C. Removing or changing default banners for network services.
Service banners often disclose the service type, version, and sometimes even the OS. Removing or changing these default banners (banner grabbing countermeasures) makes it significantly harder for an attacker to quickly identify running services and their versions without performing more intrusive and time-consuming active probing.
Why the other options are wrong
- A. An IPS at the perimeter protects against external threats but is less effective once an attacker is already internal and performing enumeration.
- B. Network segmentation helps contain breaches but doesn't directly prevent enumeration of services on a compromised segment.
- D. Patching is crucial for vulnerability management but doesn't directly prevent service enumeration, though it helps mitigate risks once services are found.
Service Banner Grabbing Countermeasures
Service banner grabbing countermeasures involve modifying or removing the default informational banners displayed by network services (e.g., web servers, SSH, FTP) to prevent attackers from easily identifying the service type, version, and underlying operating system.
- Default banners provide valuable information to attackers.
- Changing banners makes automated enumeration harder.
- Can be done through service configuration files.
- Part of defense-in-depth strategy for enumeration.
Memory trick: Don't shout your name; hide the banners to deter the curious.