Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Should you label networking equipment? is this a security risk? if we label all the networking devices within our company with its host names are we potentially giving away info that we should not?

Thoughts?

share|improve this question
    
If you are paranoid, you can scramble it. –  Andrew Smith Jun 28 '12 at 21:43

2 Answers 2

The usual is to label but not with the company or host names. Instead:

  • For police identification, use tagging with an "If found contact xxx phone number" message. Various physical security service companies can provide these as part of their support contract.
  • For asset management, use a naming convention which allows you to identify cables, devices and other items, but that doesn't provide an attacker with obvious clues to identify key devices or networks, for example "HO2FFIN4" rather than Head Office 2nd Floor Finance Team Internal Network 4
share|improve this answer

It's also helpful to ask the opposite question: What is the risk of -not- labelling equipment? Quickly you'll find some issues:

  • Can't differentiate between identical switches that are configured for different locations
  • Users can't refer authoritatively to hardware when reporting faults (Yeah it's that green thingy by the stairs with no lights on).
  • You go out on site to find something months later and don't know which one it is

You seem to imply that the only option is to label with a hostname, which is of course, not the only option. Use an Asset tag of some form, which allows for creativity. E.g. SHA1 the hostname and use the last 10 characters as the asset tag.

share|improve this answer
    
I assume that this is not a PCI compliant requirement. This is the driver for us. I am just double checking our security person who has charged me with this task. Everything that comes my way as a task is for PCI but I know that most of it is not required. I just wanted to know if this is actually has to be done? –  Rob Jun 29 '12 at 13:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.