Information Security: Part 2: 7 Data Leaks You Can’t Ignore

I received many comments on layer 2 port security from the readers of my last article, Information Security: 7 Data Leak’s You Can’t Ignore. Some readers deemed it necessary to tell me that they could bypass my controls using spoofing and other tactics and that my solution was not effective. If everyone recalls, the main purpose of my last article was to give some insight on cost effective ways to mitigate risk. I shared some of the “no cost” things that I have implemented to increase the security posture of my organization. The information I provided was not a comprehensive security program nor did I present it as such. If you have nothing in place to protect your access layer, port security is a “zero dollar no brainer solution” to protect you against the most common threats to your environment. Some of these more common threats are a vendor connecting an un-patched laptop running an outdated anti-virus to your network for a presentation. An employee connecting a wireless access point in default configuration mode they purchased at their local Best Buy so they can be more productive and work from a conference room. The purpose of port security is to guard against these common threats…not a malicious person trying to compromise your network.

With that being said, I will now share with you some additional layers of security that my staff and I have implemented to mitigate the malicious person from connecting to your network. Keep in mind this is not our comprehensive solution but I feel confident enough to share some details with you. These solutions are HIGHLY effective when no one on your network is admin of their local PC. For this, you will need the TriGeo SIM and a few hours to configure the rules and test them. If you are lucky enough to convince your Board to drop 50K on the TriGeo SIM you can rest easy. Rules can be built using their drag & drop GUI to create the following layered defense model:

Defense Layer 1
Proper physical controls: Nothing technical here. Visitors must wear badges and be escorted at all times.
End user education: Users must be educated on how to detect social engineering and the common tactics used by these individuals.
Effective policy distribution & acceptance: Users must know & understand your policies and sign a document acknowledging their roles in keeping the institution secure.

Defense Layer 2
Port-Security Violation: If the mac-address does not match my switch config file, shut port and send an email to the information security department.

DHCP No Agent: If a DHCP request is received, check for the TriGeo agent installation file. If no agent is detected, send an email to information security with the PC name and IP address.

No Anti-Virus: If a PC joins the network (DHCP or Static) and is not running Antivirus solution “X”, send an email to the information security department.

If you manage to bypass layers 1 & 2, here is Defense Layer 3
TCP/UDP Scan Attack: If “X” amount of TCP/UDP packets are detected in “X” seconds send an email to the information security department.

ICMP Scan Attack: If “X” amount of ICMP packets are detected in “X” seconds send an email to the information security department.

Admin Used: If admin, administrator, guest account or “X account” attempted authentication occurs, send an email to the information security department. This is very effective since no one in my environment is permitted to

You do not have flash or javascript support.

Average (2 votes)

Reply