Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Securing switch ports on a campus network

Physical ports in meeting rooms, receptions and lecture theatres are an access route that nothing else on this site covers, and the controls are old, well understood and frequently unconfigured.

For. Network and security staff sharing responsibility for the edge

  1. 01

    Shut down what is not in use, and say so in the description

    an afternoon

    Administratively down, and the interface description saying who to ask before it is re-enabled. The commonest finding in any campus review is a live port under a table in a public area, and it is usually live because nobody knew what it was for.

    how to know it workedCompare the running configuration against a walk around the building. A port list that matches the diagram and not the building is the usual state.

  2. 02

    Put unused and untrusted ports in a dead VLAN

    an afternoon

    Not VLAN 1, and not the same VLAN as anything real. Disabled ports get re-enabled by somebody helpful; a port that comes up into a VLAN with no route anywhere fails safe when that happens.

    how to know it workedPlug a laptop into a port you expect to be dead and try to reach anything. Testing the control is the control.

  3. 03

    802.1X where you can, MAC authentication bypass where you cannot

    a project

    This is the actual authentication control: the device proves who it is before the port carries traffic. Printers, cameras and building systems that cannot do 802.1X go on MAB, which is weaker and is honest about being a list of allowed addresses.

    how to know it workedAuthentication sessions on the switch, and a test with an unenrolled device that should land in a guest or quarantine VLAN rather than nowhere. Failing closed with no path for a visitor produces a workaround, and the workaround is usually a cable somebody left patched.

  4. 04

    Turn on the layer-two protections

    an afternoon

    DHCP snooping so a rogue server cannot answer, dynamic ARP inspection on top of it so ARP cannot be poisoned, and BPDU guard so a switch appearing in a meeting room does not reorganise your spanning tree. Each is a few lines and each stops a class of attack that is otherwise trivial.

    how to know it workedCheck the binding table has entries after a client connects. DHCP snooping configured with an empty binding table is configured and doing nothing, which is the normal way this fails.

  5. 05

    Separate management from everything else

    a project

    Switch management on its own VLAN, reachable from a defined set of addresses, with SSH rather than telnet and local accounts backed by central authentication. A network device that can be reached from a user VLAN is one credential away from being reconfigured.

    how to know it workedTry to reach the management address from a normal user port. It should not respond at all.

what this does not cover

  • Wireless, which is a separate set of controls and is usually the easier route in anyway
  • A device that authenticates legitimately and is then compromised, since 802.1X answers who is connecting and not what they do next
  • Anyone with physical access to the switch itself, which is a building control rather than a network one