Are There Risks in Sharing Firewall Logs?

FireballDWF asks: "What are the risks in sharing my personal Firewall logs with others? I ask as helping to put a stop to detect and stop attacks at their source by becoming an agent for MyNetWatchman sounds easy and appealing, but I am concerned about the possible risks." The MyNetWatchman service is designed to take a pro-active approach to network security. A network agent sits on a users firewall and forwards log entries to a central server that analyzes the data and warns the user if suspicious activity occurs. Sounds like a good plan, but what dangers (if any) will the users of this service be exposing themselves to by providing such access to their machines, even if they are just log files?

Comments

Information is power

[schon]

If the question is "Should I send my logs unfiltered to a separate entity?" then the short answer is NO.

The long answer is NO. Information on your private network numbers should be on a need-to-know basis.

By posting your IP addresses to a public database (or a central service you don't control), an attacker could use this information against you, by checking the results of their scans against what you log.

Note that this is NOT obscurity. (Contrary to what a previous poster says.)

There is nothing wrong with sending filtered log reports (remove the IP addresses, and TCP info, like sequence numbers, if your software logs them) to a central DB.