The 4G Blog

In this post, I will discuss other methods of securing a network, In particular, I’ll share specific examples we use to secure network access on our firewalls and switches.

Physical Methods

First, of course, we try to keep all network equipment in a locked room, to which access is only granted to those who must have it – the Principle of Least Privilege. From the MDF/IDF network closets, which are locked, cables are run from patch panels to wall ports. Users will only have access to wall ports that we know are in use; we keep unused ports unpatched in our switches, and plastic caps are placed over the switch ports to indicate they’re not in active use. We also place caps at remote locations to prevent users from plugging devices into inappropriate ports on a firewall – a computer plugged into the ISP’s port will cause a complete outage.

Logical Methods

The first method we use is changing the default access accounts to our devices, both by changing the default username (when appropriate), the default password, as well as the default access methods (non-standard ports). We can tell this provides some effect in access logs, where we can see attackers attempting to login to the standard ports with the default credentials.

For our accounts, we also apply the Principle of Least Privilege – different employee levels are provided different levels of access to what can be changed or viewed on the network equipment. While Tier-1 can view some items that may need to be shared with clients (like a wifi password or an IP address), they cannot change anything. Other users may be able to modify certain areas of the network equipment, but cannot change other accounts or security features.

For the actual network traffic itself, we first determine the level of default access. For many client sites, we allow any devices on the network to have access as there’s a limit to what we, as a third-party, can limit. Other areas with more sensitive information limit access to known devices through 1) disabling DHCP, 2) setting up an Access Control List to only allow certain devices to connect (after being set Static IP settings, of course).

The traffic itself is then divided into Zones, depending on where it’s physically or logically connected, and what it should be connecting to. We restrict access between Zones by default and only whitelist traffic specifically via ACL. For example, security cameras need network access, but the access doesn’t need to be complete. We limit traffic to those who must have access to the cameras and block all the rest.

We also place Guest traffic in an untrusted zone that is isolated from everything else. Hyper-sensitive devices, like credit cards, are placed in a highly-restricted zone that is heavily locked down to the bare minimum methods needed.

Finally, even the traffic itself is regulated. Since we use Next-Generation Firewalls (NGFW), we can inspect every packet to determine exactly what its purpose is, and can limit network access not only be source & destination IP, but by application (Microsoft SQL? Our software? Email? Facebook?) and decide if it’s allowed. We can also add features that will reject traffic if the remote destination fails an SSL inspection, and we have features that will block traffic if it resembles a malicious actor. We can also limit traffic based on the country of destination, or limit it to specific websites and domains (either via IP or FQDN).

These are just some of the methods we use to secure the actual network traffic, in addition to access to the network management itself, discussed in another post.

Proper network security is important for multiple reasons – prevention of liability that might arise from secrets, confidential information, or Personally Identifiable Information (PPI) being leaked, as well as prevention of general network instability and losses arising from said instability and delays in network operations.

Security Terms

Network security revolves around several key terms, several of which have been mentioned in other posts. The main terms used are risk, vulnerability, and threat.

A Threat is probably the first thing people think of – a threat is an actor that causes network problems, either an external actor (such as a hacker, ransomware, phishing, or cyber attacker), or an internal actor (such as a disgruntled employee, or possible just someone who doesn’t realize the consequences of their actions). Threats should be identified and some mitigation done (mentioned later) to minimize the potential for the threat to be realized.

A Vulnerability is some flaw in the network or security design that allows an actor (internal or external, malicious or accidental) to cause a problem. A user who doesn’t understand what phishing is a threat; an email system that allows phishing emails to be delivered to users is a vulnerability. Vulnerabilities can be mitigated with best practices, and should be thought of as the doorway through which a threat enters the network.

Finally, Risk is the consequence of a threat exploiting (purposely or accidentally) a vulnerability. In other words, Risk = Vulnerability x Threat. A larger vulnerability, or a larger threat, can magnify the consequences and the risk that can arise – financial, reputational, or other – even in the absence of the other being large.

Audits

Network audits can be done by general staff, or they can be performed by experts in the field. Network auditors will work to identify vulnerabilities by leveraging their understanding of network operations with existing threats. They will utilize knowledge of common vulnerability exploits to find weak points in the network design. After doing this, they will seek to assign possible risks that can arise, mitigation strategies, and assist in implementing a strategy to reduce vulnerabilities, identify threats, and thereby reduce possible risks. An auditor can even try to obtain physical access to network resources to test physical, as well as logical, security.

Logical Security

Logical Security covers methods involving, primarily, software – means to secure the network against vulnerabilities and threats. These can include forms of encryption – commonly, installing network certificates to provide security that resources being used are what they appear to be. Logins can be synced across multiple systems to provide some type of SSO (Single Sign-On) so that more powerful methods of authentication can be leveraged, and users won’t have to remember as many passwords. MFA (Multi-factor authentication) can be used so that, if one type of authentication is stolen from a legitimate user, the login still fails in the absence of a second form of authentication.

Networks can also be designed so that users only have access to the parts of the network needed. VLANs – Virtual Local Area Networks – can be setup so that users are prohibited from access to network resources and other areas of the network that are outside the scope of their job responsibilities. The Human Resources department may need access to network shares and HR software, for example, but they don’t need access to manage the SQL databases behind that software. A Guest Wifi can be set up and logically isolated from the rest of the network so that company guests (or employees’ own personal devices) can have internet access without secure network access. BYOD (Bring Your Own Device) setups can be even more restrictive, and isolate all devices from others.

Principle of Least Privilege

In all of these designs, the “Principle of Least Privilege” should be kept in mind – users should have the absolute bare minimum access required for proper job performance. While it can be tempting to provide “all access” to simplify management, this provides opportunities for an employee to become an internal threat (deliberate or accidental) by leaking access through a vulnerability to a system they should have never had in the first place.

In another post, I will discuss Physical security methods (locks, port disabling, and so on) that can also be used to secure network resources.