Securing a LAN without Physical Security

Question

I've got an interesting dilemma. I have a large (50+ users) office that is going to be on the campus of a local university. The purpose is to foster collaboration, etc, but the open environment is going to play merry hell with my network security.

Basically, I have physical security on my demark/server room, and that's it. Worse, all the computers will have WAN access, so the security issues aren't limited to the local office, but to the entire (huge) company.

I'm tightening things up as much as possible. All machines are bound by MAC, the WAN access is restricted as far as it can be, etc, and I'm doing a few tricksy things, like doing automated OS/hardware probes to watch for MAC cloning.

Still, I'm a bit worried. Lack of physical security is freaking me out. What would you guys recommend?

Answer 1

Does your hardware support vlans and port security? Just run those machines on a different vlan. Then have Access control lists to control access to the WAN. Assuming your switches are physically secure that alone should be secure enough for most applications. Seeing as you already have a list of mac address's to be allowed you could set up port blocking as well.

I don't usually agree with using mac addresses as a form of authentication. It is a lot of work for something that is so easily bypassed. It best it might deter someone from hooking up a stray laptop to the network but a half dedicated attacker could get by it in seconds.

Setting up an encrypted VPN would give an extra leyer of security if you think it is worth the extra work. A VPN is probably way less work than dealing with MAC addresses.

Answer 2

I agree with SteveS, what are you trying to secure?

1. Figure out what you need to secure (what data is important and what isn't)
2. Figure out what risks you have for that data/resources
3. Build your security around mitigating those identified risks

This will let you balance between restricting users and letting them openly collaborate. And also when folks complain about your restrictions you'll have great firepower to backup what you've done.

Answer 3

So I have seen this one from several customers in past year. Dot1x is behind the movement across the enterprise. Slow but sure.

Its essentially a portion of NAC reinvented. So user plugs in, not in MAC DB, they get web auth screen to get on core network - or sent to the guest network based on the policy. In addition they would be challenged for posture and profile if this service is turned on.

They would put in their AAA credentials - talking to an AD server and allowed on the network based on posture and profile and policy - they are granted network access. There are several vendors in the category - BradFord Networks, ForeScout, and Cisco's ISE. These technologies monitor various portions of the network to understand the devices getting plugged into the network and build a DB overtime.

They are trying distingish the ability to separate the person from the device as well under the BYOD use case. So in this example you could have a employee come into the campus room - use his credentials but is NOT be allowed on the school network because his IPAD was not allowed on the network without correct profile and posture assessment. He would be sent to the guest network until it was resolved.