1

At our office we have a router on the table, and the powers that be want to lock it down by MAC address to stop people from plugging in cables for other computers i.e. intruders.

Given that resetting the router to factory settings to bypass the password will wipe out all the configuration (it has to be manually entered static IP & DNS settings) it will prevent unauthorised use of the internet with it. Our live server can only be accessed from this IP which is the reason for the security.

Are there any inherent flaws in doing this from a security perspective?

Improve this question
1
  • 3
    if you have an intruder physically in your office connecting to your router by wire then (IMHO) I would suggest that your problem is at least a tiny bit bigger than a simple MAC address issue.
    – KnightHawk
    Commented Nov 18, 2014 at 14:56

2 Answers 2

Reset to default
6

In answer to 'is there any security in locking down by MAC address', yes there is, but it is limited to accidental misconnection of equipment and simple attempts at deliberate unauthorised access.

Provided the router is physically secured (as already mentioned in Daedalus Mythos's answer), MAC lockdown will help to provide defence in depth. I suspect that the following will not apply to your setup but nonetheless, if logging has been configured to identify connection of unauthorised devices, there is likely to be evidence of someone attempting to bypass the MAC controls, which could enable investigation prior to an actual compromise occurring (in this scenario it is a detective control rather than preventative control).

Improve this answer
1
  • I'm glad you mentioned the different type of control (detective/preventative). I find that to be a factor in some of these "security measures" that have limited value. Their value can increase if you change the control type (expectation).
    – schroeder ♦
    Commented Nov 18, 2014 at 15:55
4

A MAC address can easily be spoofed, if an attacker gets a valid MAC address the security measures have been pretty much bypassed.

I'd rather ask why a router is openly on an table, where possible attackers have access to and why the live server is accessible via those IPs (no other authorization?).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .