As title says, i’m curious about the worst case scenario in which an attacker tries to hit my system.
The system configuration is the following: i have some services (important ones) accessible only trough VPN, like SSH (key-based auth only), Pihole…Others are publicly accessible, like Immich, Jellyfin (and so on…).Public ones are accessible via reverse proxy (Caddy) and protected by CrowdSec (which bans IPs outside my country and those failing auth 3 times).
What could happen if an attacker finds out a vulnerability on some public service? Would he be only able to access service’s files (like an appropriate login), or delete/encrypt data (as some cases of blackmail) or even pull out and steal my data?
I’m wondering this because i want to know if CrowdSec+Docker (to preserve permissions on the system) is enough to secure a server.
In nation state attack at least your government may be on your side.
Probably worst case for an individual is that your network is used to store or transmit illegal content. Even if a law enforcement analyst tracking a person spreading this illegal content (CSAM) knows you are basically innocent, it’s much more likely you get caught up some other way with local law enforcement or similar.
Initially, it may be hard to prove it’s not you because you are dealing with someone who is not an IT person first. This may spiral to losing your job or reputation should you do something like teach or run a club.
Regular attacks against google and the like pivot through 20+ machines. Many compromised machines will never be encrypted because the attacker needs to sit undetected for as long as possible.