Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have been engaged by a client who wants its Ethernet ports checked to determine whether port security is functioning effectively.
What can be the approach or steps to do check Ethernet port security?
What tools can be used to do the same?
In the scenario that I am third party who enters an
organization with his/her laptop and sees that there are Ethernet
ports around. Then I decide to plug in a wire and try to get into the
network. What can I do to achieve that?
This is a broad question, as there are several different ways to assess the security of Ethernet ports. However, there are a few things that are usually covered in this type of scope.
The first (and most straightforward) thing to test is whether any sort of Network Access Control is in place. If you're being asked to assess the security of a port, there is presumably some security control that the client wants tested. It might be a good idea to ask the client what, specifically, they want assessed.
The easiest way to test whether Network Access Control is functioning correctly is to simply plug into the Ethernet port and see what happens. Are you given an IP? If you set a static IP (vs. using DHCP), does that work? Or is there some agent-based access control that's stopping you from connecting? Is there a "walled garden" once you connect to the network?
Once you're connected, what can you see? Can you port scan (nmap) the local network? Are you in some sort of a segregated environment? What else is running nearby on the network? Is the network controlling your DNS, or can you resolve anything you want? Is there egress filtering to the Internet?
Lastly, there's always the physical security element: is the port in question in a public area, like a lobby or waiting room? Is that intended? Do untrusted actors have physical access to the port?
From the answers to these questions, you should hopefully be able to determine how secure the Ethernet setup is -- and hopefully write recommendations to improve security based on what you find. Like I said earlier, though, you should definitely check with the client before doing any of this stuff -- they'll know what their goals are, and should be able to tell you what they want to learn.
Good luck!
If the port is connected to the network switch, and the network serves up DCHP, then the laptop will get an IP address and gateway, and will likely be able to gain access to the network. NMap could then be used to map out the network.
To help protect against this, the customer can either move to static IPs, use MAC address filtering, and/or find a firewall that will notify them when a new device (MAC address) is detected. The Untangle firewall has this capability. Untangle also has a feature called captive portal, which requires a sign-on in order to access the Internet. Some switches, including those from Juniper, also have this capability.
