About nugentec

Thanks @SRohatyn! That helps a lot.   Any idea about the second part of my question? 1)  Start -> S3 bucket is not public-write-able 2)  Config Audit starts and does not report any incident 3) During the config audit scan, the user enables public writes on S3 buckets 4) Before the config audit finishes, the user makes the S3 buckets not public-write-able again 5) Will the Config audit show any incident after it completes? Or will it be oblivious to the fact that changes were made during the Config Audit? ... View more

Thanks for your response Mike. It's what I need to help my manager make a few key decisions. However we are hung up on one of your responses. You stated "There shouldn't be any applications that we have App-IDs for that benefit from allowing unknown traffic." If this is the case, why is unknown-tcp a required application dependancy for applications like share-p2p and bittorrent? If the "unknown application group" is not used to identifiy applications like share-p2p, why is it a dependancy? Can you please clear this up for me? Thanks, FJ ... View more

Thanks for getting back to me. For the time being, do you have a list of applications that either require or benefit from allowing unknown-tcp, *-udp, *-p2p? Or in other terms, would creating a policy which allows the "unknown group" traverse the firewall, would it lead to the firewall identifying more applications? Are there any applications that cannot be identified without the "unknown group" being enabled? I need to make a case to my manager to whether or not we should allow the "unknown group" and having a list of applications that benefit from it would help my case. As far as application dependencies, I would prefer to find out either while I'm editing the security rule base or beforehand from a document. I don't care to wait during the commit process. For my team and I its a personal preference. I appreciate your help on this. Thanks, FJ ... View more