1

Currently we are working to secure our internal LAN and due to this we are planning to stop mobile devices (such as personal laptops and mobile phones) to connect on corporate network. Our key area of interest is to counter such users who manage to change MAC address of home devices with the allowed one and bypass LAN security. There can be many cases but this is the one we shared as an example.

2 Answers 2

1

The closest one can get to perfect security for network access is issuing corporate devices with provisioned TPMs and using 802.1X with key material in the TPM.

A proper TPM should never let the user exfiltrate the network access keys from the TPM. They then cannot be copied to a new device.

There might be expensive processes and hardware (relative to doing nothing) to get this to work. So depending on the balance of security and corporate fiscal responsibility, MAC whitelisting tends to be a solution despite it's obvious drawback.

5
  • What hardware? Most computers have TPM's.
    – vidarlo
    Commented Sep 11, 2023 at 8:01
  • It's been awhile since I researched this answer but if I remember correctly there was a premium on the networking hardware which could support this TPM facilitated authentication procedure.
    – foreverska
    Commented Sep 11, 2023 at 14:08
  • Wouldn't that be normal RADIUS with a certificate stored in the TPM? Windows supports that out of the box afaik?
    – vidarlo
    Commented Sep 11, 2023 at 20:49
  • 1
    I don't remember my original reasons for that sentence. I have softened the wording.
    – foreverska
    Commented Sep 11, 2023 at 21:09
  • It's anyway a good answer worth an upvote :)
    – vidarlo
    Commented Sep 11, 2023 at 21:15
0

Our key area of interest is to counter such users who manage to change mac address of home devices with the allowed one and bypass LAN security.

Note that this may not be intentional or malicious (I hope so). Some network components such as Network Manager may be configured to randomize the MAC address, especially when scanning for access points, because the MAC addresses can be sniffed over the airwaves.

It is also conceivable to allow users to use your connection for personal use but keep them in a guest VLAN separate to the rest of your corporate infrastructure. If you really don't want that, then you should consider monitoring the logs to catch offenders on the spot.

If you implement NAC, on wired connections the switch can tell you which port failed authentication, in fact the switch can even block the port, forcing manual intervention. Then it's rather obvious who the culprit could be.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .