Yes, back in the day we used to dig Paul Simon, and I must say Graceland is still an album that deserves listening. But what is the connection to a Web server?
Well, a few years ago we developed ServerMask and have since promoted the concept of server anonymization for IIS and all Web servers. The analogy is simple: use camo to hide the Web server and misdirect hackers looking for Web server fingerprints to think you are running something else. They attempt an attack based on this false information, and firewalls and IDSs do the rest to cut off the attack. ServerMask, combined with content negotiation and code obfuscation, covers about 60% of the server anonymization task as we see it, and we have provided a few tips to go beyond these tools to mask the OS. Many folks did not like ServerMask initially ("AHHH, that's just security by obscurity") and thought that full Web server anonymization was just a myth, but Port80 continues to see government and financial organizations interested in the product.
Port80 is working hard to get a new version of ServerMask released that will take anonymization even farther, and we were excited to hear about a recent new industry group putting together fingerprints of hacker attacks for enhanced security response, zero day attack stemming, and more. This is the flip side of server anonymization -- attack identification -- and both are elements of a great defense-in-depth strategy.
OK, so you may still feel that ServerMask is a “myth of fingerprints“, but you have to admit that camo is still useful on a tank and could be very useful to your essential Web-based e-commerce and business systems.
Well, you don't have to admit it, actually, but it never hurts to ask. : )