Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've got an interesting dilemma. I have a large (50+ users) office that is going to be on the campus of a local university. The purpose is to foster collaboration, etc, but the open environment is going to play merry hell with my network security.

Basically, I have physical security on my demark/server room, and that's it. Worse, all the computers will have WAN access, so the security issues aren't limited to the local office, but to the entire (huge) company.

I'm tightening things up as much as possible. All machines are bound by MAC, the WAN access is restricted as far as it can be, etc, and I'm doing a few tricksy things, like doing automated OS/hardware probes to watch for MAC cloning.

Still, I'm a bit worried. Lack of physical security is freaking me out. What would you guys recommend?

share|improve this question
3  
It's a good question, but I guess the important to thing to know is what are you wanting to specifically protect against? –  SteveS Feb 17 '12 at 18:59
2  
Do you have pii stored on the system? –  Jeff Feb 17 '12 at 20:08
    
The next step would be layer 2 authentication using any 802.1x product. –  ceving Feb 21 '12 at 16:04
add comment

3 Answers

up vote 6 down vote accepted

Does your hardware support vlans and port security? Just run those machines on a different vlan. Then have Access control lists to control access to the WAN. Assuming your switches are physically secure that alone should be secure enough for most applications. Seeing as you already have a list of mac address's to be allowed you could set up port blocking as well.

I don't usually agree with using mac addresses as a form of authentication. It is a lot of work for something that is so easily bypassed. It best it might deter someone from hooking up a stray laptop to the network but a half dedicated attacker could get by it in seconds.

Setting up an encrypted VPN would give an extra leyer of security if you think it is worth the extra work. A VPN is probably way less work than dealing with MAC addresses.

share|improve this answer
add comment

I agree with SteveS, what are you trying to secure?

  1. Figure out what you need to secure (what data is important and what isn't)
  2. Figure out what risks you have for that data/resources
  3. Build your security around mitigating those identified risks

This will let you balance between restricting users and letting them openly collaborate. And also when folks complain about your restrictions you'll have great firepower to backup what you've done.

share|improve this answer
add comment

So I have seen this one from several customers in past year. Dot1x is behind the movement across the enterprise. Slow but sure.

Its essentially a portion of NAC reinvented. So user plugs in, not in MAC DB, they get web auth screen to get on core network - or sent to the guest network based on the policy. In addition they would be challenged for posture and profile if this service is turned on.

They would put in their AAA credentials - talking to an AD server and allowed on the network based on posture and profile and policy - they are granted network access. There are several vendors in the category - BradFord Networks, ForeScout, and Cisco's ISE. These technologies monitor various portions of the network to understand the devices getting plugged into the network and build a DB overtime.

They are trying distingish the ability to separate the person from the device as well under the BYOD use case. So in this example you could have a employee come into the campus room - use his credentials but is NOT be allowed on the school network because his IPAD was not allowed on the network without correct profile and posture assessment. He would be sent to the guest network until it was resolved.

share|improve this answer
2  
From a user experience perspective, those web-based authentication screens are really annoying. First off, I can't start using the network until I start typing a username and password into my web browser; ugh. I prefer being to open the lid on my laptop and get to work. Second, it hijacks DNS and your browser. If I launch my browser and it tries to open a dozen tabs (the ones that were open when I closed it), DNS hijacking steals all of them, and messes up all my tabs. Beware security measures that make usability suck; they have significant long-term costs. –  D.W. Feb 22 '12 at 2:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.