The one question to ask a security team that will tell you if their company is secure

Well, okay, it won't actually tell you whether they are secure or not and there are other questions you could ask, but the point is you can tell a lot about a company's security by how they answer security questions. I was recently at a security round table and the conversation turned to third parties and how you can assure yourself of their security. Some advocated scoring companies or certifications, while others advocated sending questionnaires. The argument against questionnaires is that they are a point in time view of the organisation. However, you can ask process and policy based questions and you can tell a lot from how they answer.

So, what is the question that will reveal all? Well, as I said it's not one question as such, more a type of question. It should be about something basic, some security control you're sure they have because everyone does. For example:

Why do you have a firewall?

Probable answers:

• "because everyone has one"/"because the course I went on said I should have one"/"because my last organisation has one and they are very secure" - bad answer, you're not thinking about controls or security, but instead just buying popular products or whatever the vendor sells you and undoubtedly have a false sense of security
• "because our PCI/ISO/HIPAA/Other certification says we have to" - bad answer, you're ticking boxes and chasing compliance rather than actually trying to be secure
• "well, a firewall is part of a secure layered architecture and enables segregation at the network level, restricting the ingress and egress... etc." - okay answer, at least you know what it does and may understand its limitations
• "our threat modelling has identified threat actors and attack scenarios that can be mitigated, in part, by introducing a firewall at this location in our network" - good answer, you understand the technology, you are thinking how to deploy it, what technologies could help you secure your assets and what are the best projects/controls you can spend your limited budget on to reduce risk

I have done (and still do) many third party assessments and I do advocate asking them questions rather than just trusting someone else's word or a rating/certification of some sort, but I'm mostly interested in how they answer questions. I've seen too many 'compliant' companies say "We're secure, the U.S. Government uses us!" or "All the high street banks use our service!", yet fail close inspection and have glaring weaknesses or vulnerabilities.

Trust your own judgement; ask them a question. And if you're a third party, ask yourself the question... with all your controls.

Web Hosting Security Policy & Guidelines

I have seen so many websites hosted and developed insecurely that I have often thought I should write a guide of sorts for those wanting to commission a new website. Now I have have actually been asked to develop a web hosting security policy and a set of guidelines to give to project managers for dissemination to developers and hosting providers. So, I thought I would share some of my advice here.

Before I do, though, I have to answer why we need this policy in the first place? There are many types of attack on websites, but these can be broadly categorised as follows: Denial of Service (DoS), Defacement and Data Breaches/Information Stealing. Data breaches and defacements hurt businesses' reputations and customer confidence as well as having direct financial impacts.

But surely any hosting provider or solution developer will have these standards in place, yes? Well, in my experience the answer is no. It is true that they are mostly common sense and most providers will conform to many of my recommendations, but I have yet to find one that, by default, conforms to them all.

Site Categorisation

There are several different categories of hosting and several different ways to categorise sites, with different requirements. However, in my opinion, sites should be categorised based on the information that they contain and the level of interaction allowed. Sites should then be logically and physically separated into their categories.

Sites can be categorised as brochure sites if they have static content or do not collect information. These sites can then further be categorised into public or private depending on whether the data that they contain is public or not. Sites within these categories may be co-hosted with other sites in the same category, but the two categories should be segregated.

Sites can be classed as data collection apps if they collect sensitive or personally identifiable information (PII) from the user. Sites within this category should be hosted on their own servers with no co-hosting and be segregated from all other sites. The data must be stored on separate segregated database servers that are secured and firewalled off.

Finally, any site with even more sensitive data on it or company secrets should be hosted internally if you have the expertise in house.

Hosted Environment

The following list is an example of the requirements for secure web hosting. It is not necessarily complete, but if you do not have the following then you may have issues in the future. All websites and web applications must:

• be hosted on a dedicated environment - the hosting machine may be virtual or physical, but must not be shared with any 3rd parties. Multiple websites and applications from the same company may be hosted on the same machines according to the categories above
• have DDoS protection in place
• have AV running and configured properly on the server along with appropriate responses and reporting
• be hosted behind a Web Application Firewall (WAF) to protect against common attacks, plus allow the ability to configure it for specific services
• be hosted on security hardened Operating Systems (OS) and services to an agreed build standard
• be subject to regular and timely patching of the OS and services
• be subject to regular security testing and patching of any Content Management System (CMS) in a timely manner if used
• be subject to active monitoring and logging by the provider for security breaches and reporting to/from the organisation
• have formal incident management processes for both identifying and responding to incidents
• not be co-hosted with additional public services beyond HTTP/HTTPS (e.g. no public FTP)
• not allow DNS Zone Transfers
• use proper public verified SSL certificates - with a preference for Extended Validation (EV) certificates
• ensure that management services and ports are on different IP addresses and domain names preferably, but must not be available through the normal login or visible on the website
• ensure that administrative interfaces and services are restricted to certain IP addresses at least, but make use of client-side certificates or two factor authentication (2FA) if possible
• ensure staging servers are available for test and development, which must not be shared with live sites and should be securely wiped at the end of testing as soon as the site is deployed live
• ensure staging and test environments are not available on the public Internet or, if there is no alternative, they must be devoid of branding and sensitive information in all ways and restricted as above
• be built on a tiered architecture, or at least the database (DB) server must not sit on the same server as the web front end, must not be accessible from the Internet and must be securely segregated from the front end
• use encrypted storage for all sensitive information, (e.g. passwords and sensitive information)

Hosting Services

It is up to the hosting provider and third party developers, but should be backed up by specific contractual clauses, to ensure that:

• the site is backed up regularly off site in a secure location using encrypted media where the keys are stored separately from the media and able to be restored in a reasonable time frame with a suitable rotation and retention policy
• hardware and media that has reached the end of its life is securely destroyed
• all sites are made available for pentesting prior to going live and at regular intervals
• all vulnerabilities considered of medium risk and above should be remediated prior to go-live
• all sites are available for on-going regular automated Vulnerability Assessments
• domain names, code and SSL certificates are registered to the company and not a third party
• there are agreed processes for identifying approved personnel to authorise changes
• change management processes that track all changes are in place along with rollback and test plans
• capacity and bandwidth are actively managed and monitored
• all management actions are accountable (unique accounts allocated to individuals)
• all management should be through secure ingress from trusted locations
• egress filtering should be in place to block all non-legitimate traffic

Telephone Systems a Hackable Backdoor?

I have been talking to a company that provides telephone exchanges and services to companies this week on behalf of a client and it has highlighted a worrying backdoor. It turns out that many of these companies have a way to remotely connect to their exchange for support purposes - they can remotely control, configure and troubleshoot your system to get you back up and running. Exchanges often have additional modems in them to allow for remote connections. This is all very well and good from a managed service point of view, but what about the rest of your network? Can this be exploited to gain entry to your network? Quite possibly in some cases - it certainly needs to be included in your security audit and perimeter testing.

Talking about a specific company now, they supply the software to monitor and bill phone calls through the exchange. They remotely install, monitor and manage this software. How do they do that? Well, it turns out that they install LogMeIn on your machine. Now this will make outbound connections through the firewall to make the internal machine accessible from the outside world. Hang on; you're making my networked machine that controls my exchange and billing accessible by anyone? By default LogMeIn will use simple username/password type authentication.

The user who accesses the computer has to set up their account with LogMeIn and will use the same username and password combination on all machines as far as I can see. Does the company have a universal account that they use to remotely access the machines or does each user have their own? If the company uses one default username/password, then what happens if someone gets hold of that information or someone leaves? Does the password get changed? If everyone has their own account, then are they removed when they leave the company? As this is all done through the Web, they could still gain access if they aren't specifically removed from the user group.

How much do you trust all the employees of that external company? How much do you trust the disgruntled ex-employee from them who has access? It might not be that they are trying to attack you, but they may be careless about the credentials or not revoke them properly. Also, consider the case where all the internal employees of an organisation are required to have 2-factor authentication and remote access is locked down. What's the point? There is a simple username/password entry point into the network that bypasses all the secure remote access services you may have in place. How secure are the passwords that the external company use? Would they match up to your complexity requirements? If they are simple, easily guessed or shared, then they open full administrative control over a machine on your 'secure' internal network. Who patches the machine and who updates LogMeIn?

How about installing a keylogger in such a firm to pick up on their username/password combinations so that you can gain full access to every customer's network. Once on the internal machine, malware can easily be installed and attacks launched on other internal machines unhindered. How many organisations have followed best practice and installed a UTM firewall in the core of their network to segregate their servers, etc., from other internal machines? Would a machine running this software be on a normal user subnet or on the management subnet anyway? Do many SMEs have more than one subnet anyway?

Needless to say, my advice was to avoid installing LogMeIn on the machine and temporarily allow a more controlled access to the machine with a temporary account, all of which can be disabled immediately after remote installation is completed. This opens up the problem of how to obtain support, but access can be temporarily granted and then removed when support is required with relatively little effort.

Clearly any such system needs to be well documented and be part of the security audit. I would advise that companies also ask for security audit and policy information from any external company who has any kind of access to the network - this should be standard procedure.

Proposed Pseudo-Code for Hacking Process

It is quite common in Information Systems to use pseudo code to describe a process. I have often thought that the same principle can be applied to the process of hacking an organisation, which may help people understand the process and how to protect themselves. Below is my proposal for this pseduo-code for the hacking process. This is very much a work in progress. I would welcome feedback on it and I will update it as suggestions are made or as I feel it needs revising.

organisation = proposed target
organisation.footprint(value, effort, risk)
profit = value - (effort * risk)
if profit > 0 then
  organisation.enumerate()
  select attack_type
    case DoS
      engage_botnet(myBotnet)
      myBotnet.launchDDoS(organisation)
    case Access
      organisation.gainAccess(myAccount)
      myAccount.Elevate()
      organisation.installBackdoor(myAccount)
      organisation.cleanUP()
  end select
else
  exit
end if

This highlights the fact that we only need enough security to make it not worthwhile attacking, i.e. it will cost the attacker more to compromise our system than they will gain. Who would spend £1m to get £10 worth of information? We don't need (indeed cannot have) absolute security, just enough to protect our system. It also highlights another interesting point. Perhaps we should make our countermeasures public - not the actual implementational details or versions, but the fact that they are in place, e.g. that we have an IDS. Consider blatant versus hidden CCTV cameras. Cameras in plain sight deter most criminals, whereas hidden cameras spy on criminals while they perpetrate their crime.

We want to make the risk of being caught/prosecuted value high, so that hackers require a higher value:effort ratio, which we won't give them. Given two identically protected organisations with the same value, would you attack the one that doesn't monitor activity or the one that does?

Obviously, the above is very vague and doesn't provide methods to complete these tasks, but that is not the point of this post. Backdoors and Trojans are usually relatively easy to install if you have the right level of access to the system, so much of your security is going to hang on stopping a hacker from gaining access. Gaining access to an organisation is usually performed in one of four main ways:

• Malware
• Sniffing
• Direct Attack
• Social Engineering

There are ways to protect yourself, up to a point. Some of the most critical are:

• Installing Antivirus/Antispyware
• Latest OS and Application Patches
• Enterprise-level firewall, with IDS/IPS, AV, etc.
• Personal firewalls on all mobile devices
• Secure, hardened configurations
• Browser lock-down
• Encrypted communication (e.g. SSL/TLS, VPN, etc.)
• User Education!

The last point is often overlooked as a critical security practice. Please feel free to comment.

Wireless Network Security Recommendations

Wireless Networks are still causing businesses problems. By their very nature they are insecure, as they are a broadcast network that frequently extends beyond your physical boundary - remember radio signals don't stop at your door. There ARE security mechanisms to make them secure, but too often these are not implemented properly or are circumvented by users. It is vital that all traffic on the wireless network be encrypted, and connections authenticated, otherwise anyone with a laptop can view all your traffic. There are many mechanisms for achieving this, but at the very least you should use WPA with long pass phrases (not simple passwords) and MAC address authentication.

Don't use WEP; it can be broken easily. I won't bore you with details here, but I refer you to Google instead. However, there are several flaws such as using a linear Integrity Check Value, such that predictable bit-flipping can be used to send invalid messages that will appear to be valid. Secondly, the 40-bit shared secret is 'extended' by use of a 24-bit per-packet Initialising Vector. As any cryptographer will tell you, the more often you use the same key, the easier it is to recover the plaintext (particularly if you have known plaintext, which we do have in the headers of network packets of course). IV collisions happen surprisingly quickly, especially on corporate wireless networks, as they will usually have reasonably heavy load. TKMaxx found this out the hard way when they lost half a million credit card details to a hacker sitting in their car park. This also shows that they almost certainly didn't segregate the traffic and force it through a firewall.

So what can we do about this? Well, all modern equipment will support Wi-Fi Protected Access (WPA) and WPA2. A standard implementation of this is to use a Pre-Shared Key (PSK), i.e. a pass phrase, and the AES block cipher for encryption. This is the minimum requirement for a wireless LAN. Again, don't use simple passwords, as the security of your system is relying on them. You should use long complex pass phrases, with punctuation. Another idea is to encrypt a pass phrase using itself (or another) as a key in an encryption tool; then use the resulting base-64 encoded string as your PSK. However, automatic key negotiation and the use of digital certificates is a better option in a corporate environment (remember for wireless access you can run your own internal certificate server so that you don't incur additional costs).

This doesn't solve everything though. A little while ago the head of a department in an organisation I was involved with decided that he didn't want to have to use the docking station for his laptop as it constrained where he could work in his office. So, he didn't contact the IT department, but instead went to his local IT retailer and bought a cheap wireless access point. He plugged this into the network and, not only did he not configure any security, but he didn't even change the default password on the device. Do you categorically know that you don't have a rogue access point on your network? This can be stopped by using technologies such as 802.1X port-based authentication and a RADIUS server.

Wireless networks also need to be treated as insecure and separated from your wired network via a firewall, with real-time virus checking and an Intrusion Detection System. This doesn't mean that they have to be unprotected themselves; you should still protect them from outside attack by firewalling them off from the Internet. The important point is not to let traffic flow, unchallenged, from the wireless network onto the wired network. This is not often done though. I was in Vienna recently on business and the hotel I was staying at had free wireless access for guests. However, one night I couldn't get access and asked why. I was told that they had switched it off as someone was trying to access their servers (they weren't very proficient or experienced hackers fortunately). The point that I found more worrying was that their public wireless network was directly connected to their servers, which the hold names, addresses and payment details of guests and even the door card programming details! You can imagine what could happen if someone were to get into the servers...

Wireless networks and wired networks should not coexist on the same subnets. This is for two reasons. Firstly, it is easier to attack and, therefore, attach to a wireless network, so you don't know categorically that all stations are legitimate. Secondly, most wireless networks are used to connect mobile devices, such as laptops and netbooks, to the network. Do you know that these haven't picked up any malware whilst not connected to your corporate LAN? You can address the latter with network access control, but that's a different topic. However, all traffic from the wireless network should be treated with a level of suspicion and therefore separated. You don't have to have a separate Internet connection or new wiring to achieve this; VLANs (or Virtual LANs) can solve the problem by logically segregating the traffic into the firewall. This also allows you to provide public wireless access for visitors/customers as you can run two separate, VLANed wireless networks through the same access points onto the network - one with limited access to the corporate LAN and the other with none.

Wireless networks can be implemented securely, but remember to separate your wired and wireless networks and implement secure encryption and authentication.

The PCI DSS and Why It's Relevant to Everyone

Many of you will know that PCI DSS stands for the Payment Card Industry's Data Security Standard and most of the rest of you have probably heard of it and wondered what it was. You may immediately say I'm not interested in the Payment Card Industry and want to navigate away, but just before you do, you should know that many of the 12 recommendations are relevant to all. Actually the PCI DSS recommendations are mostly common sense that we should all be implementing anyway. I'll give a quick overview of the big 12 and how these can be applied to all networks in this blog.

According to the PCI Security Standards Council, "The core of the PCI DSS is a group of principles and accompanying requirements, around which the specific elements of the DSS are organized." The 12 recommendations that they put forward can be generalized as follows and should be adhered to by all organisations:

1. Install and maintain a firewall configuration to protect private/sensitive data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
3. Protect stored data
4. Encrypt transmission of private/sensitive data across open, public networks
5. Use and regularly update anti-virus software
6. Develop and maintain secure systems and applications
7. Restrict access to private/sensitive data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to private/sensitive data
10. Track and monitor all access to network resources and private/sensitive data
11. Regularly test security systems and processes
12. Maintain a policy that addresses information security

Dealing with each very briefly, I’ll try to show how these can be applied to a ‘normal’ network rather than one involved in dealing with payment details. Firstly, we all know that we must have a firewall and block access from the outside world. However, just having a firewall isn’t enough, if it isn’t configured and managed properly. Every port and service open through it must be justified and have clear documentation. There must be policies and procedures in place to control the opening of ports and services through the firewall so that each one can be assessed for its impact on the overall security. Wireless networks should also be separated from wired networks by the firewall – this doesn’t mean that the wireless network has to be unsecured from the Internet or that it has no access to the wired network, just that restrictions and filtering should be in place between them. Obviously, there should be no access from outside the network into the network, as a DMZ should be set up for all public access machines. Finally, personal firewalls should be installed on all mobile machines and hardware firewalls installed at users’ home premises if external access is to be allowed.

The second should be obvious and doesn’t really need any explanation, other than to say disable as many features as you can and don’t allow any configuration or management from outside your network. There are ways to enable secure remote access to the network, thus allowing for management of servers and devices to be achieved from within the network.

The third and fourth requirements go together and mean that strong authentication is required and permissions set appropriately. However, we should also implement encryption on highly sensitive data and removable devices/mobile machines, with proper key-management processes, and Digital Rights Management (DRM) to prevent digital leakage. All data transmitted across public networks should be encrypted (whether sensitive or not).

Is there anyone who doesn’t follow point 5? You’d also think that the zyxst (6th) recommendation would be followed by all organisations, but this isn’t the case. You must have proper patch management procedures as these are critical to securing potential vulnerabilities. However, how many times do you see that the state of the server or service is lagging behind the latest patches? I have seen many commercial outfits developing web applications that are not secure as security is an afterthought and not embedded in the development cycle. This means that, even if you don’t write your own applications, you must check third party applications that you intend to use on your network. Make sure that they have been developed using secure coding guidelines and have been independently tested. An example of not taking it for granted is Apple, who has no formal security program (ref.).

The seventh recommendation sounds obvious again, but it isn’t followed even by many of those covered by the PCI DSS. Restrict access to your data by business need to know. Does your network administrator need to know everyone’s personnel details and payroll? No, so make sure they don’t have access. This is an often overlooked problem, but many organisations rely on people not looking rather than actually protecting the data. How many examples can you quote of companies, and government organisations, losing confidential data that they should never have been able to access? An example springs to mind of a large retailer that lost the names, addresses and credit card numbers of millions of customers, which were copied onto a laptop. Why would you need all this data? Presumably you want it for business intelligence purposes and data analysis. This can, and should, be delivered live through secure channels, not done from a local copy. Why do you need their credit card number though? The point is that it shouldn’t be possible to extract this data and store it on the laptop in the first place. The next two are also related to this and a previous point of requiring strong authentication, which means that you must not allow sharing of user accounts by employees (especially executives giving passwords to PAs!).

Recommendations 10 and 11 deal with monitoring and testing the network. In order to make sure that your system is functioning as expected and that your security mechanisms are appropriate and don’t have vulnerabilities, you need to monitor the network and regularly test it for vulnerabilities. Every time a significant change is made to the network, its impact on the network should be assessed and tested.

The final recommendation is to maintain an information security policy. This must cover all forms of information though, not just electronic. It should be very clear and all employees should be trained in its content and abide by the policy or face punitive measures. Employees should have to sign a copy of the security policy, stating that they have read it, understand its content and agree to abide by it. However, this has no teeth if you do not adequately train all of your employees and update them regularly on the policy and any changes.

The PCI DSS recommendations can and should be adopted by all organisations, not just those involved in payment card transactions.

How to tell if your Firewall is a full DMZ

Most firewalls have a 'DMZ' setting, but are they actually a full DMZ firewall? DMZ is a term often used in network security, but it can mean two different things to manufacturers and practitioners. Technically, there is no such thing as a DMZ in a firewall architecture, only a screened-subnet firewall, screened-host firewall or an exposed host, but the term is the industry standard when talking about allowing access to information servers (e.g. web, mail, etc.) from the Internet.

So what is a DMZ? DMZ stands for Demilitarized Zone and is, obviously, a military term for the no-go area between two armies where no military activity is allowed. However, in network security terms it is a secure subnet that separates the Internet from the internal machines on your network. This becomes a logical place to implement any Information Servers, as these can be partially opened to the Internet, whilst not allowing direct access to the internal network. So are all DMZ firewalls the same? Well, no they aren't. They range from small SoHo (Small Office/Home Office) routers up to full enterprise-level firewalls. Of course the majority of SoHo routers are not DMZ firewalls at all; their DMZ features are actually exposed hosts, which have less protection than a normal machine and little or no separation from the internal network. This is bad, as any successful attack on the exposed host now has free range over the internal network.

Moving towards proper enterprise firewalls, we still have two different types of firewall often referred to as a DMZ firewall; they are either logical or physical DMZ firewalls. Obviously, the physical DMZ firewall offers the best level of security, but what's the difference? The difference is that they are a screened-host and a screened-subnet firewall respectively. Although your firewall arrives as a single rack-mounted unit, internally it is made up of a set of components - most notably packet filtering routers and a bastion host. The packet filtering routers simply permit or deny access based on IP address, TCP port number or protocol type. More sophisticated functionality is implemented by using proxies on the secure bastion host. The diagram below shows the logical setup of a full DMZ firewall, with a separate screened-subnet (purple) between the insecure Internet (red) and the secure Intranet (green).

The point here is that no communication is allowed directly from the Internet to the Intranet. All traffic can be forced through the Bastion Host to perform URL, content, virus and SPAM filtering, among others. In the screened-host solution, there is no internal packet filtering router or separate screened-subnet. The information servers are logically separated from the information servers, but not physically. They may be on different VLANs (Virtual Local Area Networks) and physical firewall ports, but they are only separated by the logic of these mechanisms. One way to tell if your firewall is a screened-host is to see if you can set an Access Control List (ACL) between your information servers and your internal machines and see if the virus checking will work between them as well. If you can't set up an internal ACL or perform real-time virus checking on internal traffic, then you probably have a screened-host firewall.

The most secure way to implement a firewall is to have the full screened-subnet firewall, depicted above. This solution can have multiple internal connections that are all separate networks connected via the firewall. The advantage of this is that there is physical separation between your information servers and your internal machines. Indeed, it is possible to separate your organisation internally into departments or by access medium, i.e. wired and wireless networks are physically separated and wireless networks are treated as less secure. Another 'best practice' is to have your servers separated from the rest of your network and restrict access to them. If you have an intranet server, for example, why allow more than HTTP (port 80) and HTTPS (port 443) access to it from your network? If we lock the network down in this way we can better halt the spread of malware on our internal network even if we do get infected. This is moving towards bringing the firewall in from the edge of the network to the core, to protect our network as a whole. Remember, firewalls can't protect against traffic that doesn't go through them.

Log Attack Attempts

While I was answering emails and writing another blog post, I was reminded that lots of people ask me about the seriousness of the threat of attack as they are sceptical. So, I decided to turn on additional logging on my router to view all incoming traffic to see what it is blocking silently. I can tell you that in 2 hours on my home connection here I have had 22 different IP addresses making 47 different attempts to connect to me. One tried to launch a Denial-of-Service (DoS) attack on my web server three times (unsuccessfully), and another attached to my web server to view the options available and didn't bother retrieving any pages - this is a classic sign of footprinting before an attack. The first was host 123-204-6-150.dynamic.seed.net.tw and the second was host164-120-static.29-87-b.business.telecomitalia.it.

What were the other 20 connection attempts? Well I don't actually have anything else open on my network, but by logging all connection attempts I can view what people are trying. One tried to connect to port 3389 (Microsoft's RDP port) and then 3306 (mySQL), which is maybe a slightly strange combination - Microsoft's Terminal Services machine running open source mySQL? There were 4 attempts to connect to port 135 (Microsoft's DCOM Service Control Manager), 3 attempts to connect to port 445 (Microsoft's Directory Services), 4 attempts to connect to port 3128 (Active API Server), 2 attempts at port 2967 (SSC-Agent), 3 attempts at port 8000 (iRDMI, but sometimes used as secondary web port), and so on.

There are well-known attacks for these ports that are supported under tools such as the Metasploit Framework. So, this is an unlisted private broadband connection that had 22 attack attempts in 2 hours. What people have to realise is that computers are very good at doing repetitive, mind numbing tasks. You can scan a range of IP addresses very easily from tools that you can download for free. If they get a reply to these sweeps then they can investigate. If your firewall isn't blocking all these ports then you will get attacks. That's not the end of the story though. If your firewall responds to these connection attempts then you are telling the attacker that there is a machine there to be attacked. How do you stop this?

When one machine tries to connect to another over the network several things can happen, but the two main ones are: the port is open and a service is running on it accepting connections, in which case the connection will be successful; secondly, the port is not open and the service that would use that port isn't running, in which case your machine will respond telling the originating host that it isn't listening on that port. Now it is worth running a full port scan to find out what it is listening to (and yes, before you ask, you can defeat the port scanning alerts on firewalls fairly easily in most cases). This is what you must stop by stealthing unused ports, i.e. if a connection attempt comes in on a port you aren't using, discard the packet and do not reply. Most firewalls will do this for you if you configure it, but make sure that it is set up correctly.

One final note, always log attack attempts and never set your firewall to reply to pings on the WAN port!

P.S. I've had 7 more since starting to write this post.