In this post, I will discuss other methods of securing a network, In particular, I’ll share specific examples we use to secure network access on our firewalls and switches.

Physical Methods

First, of course, we try to keep all network equipment in a locked room, to which access is only granted to those who must have it – the Principle of Least Privilege. From the MDF/IDF network closets, which are locked, cables are run from patch panels to wall ports. Users will only have access to wall ports that we know are in use; we keep unused ports unpatched in our switches, and plastic caps are placed over the switch ports to indicate they’re not in active use. We also place caps at remote locations to prevent users from plugging devices into inappropriate ports on a firewall – a computer plugged into the ISP’s port will cause a complete outage.

Logical Methods

The first method we use is changing the default access accounts to our devices, both by changing the default username (when appropriate), the default password, as well as the default access methods (non-standard ports). We can tell this provides some effect in access logs, where we can see attackers attempting to login to the standard ports with the default credentials.

For our accounts, we also apply the Principle of Least Privilege – different employee levels are provided different levels of access to what can be changed or viewed on the network equipment. While Tier-1 can view some items that may need to be shared with clients (like a wifi password or an IP address), they cannot change anything. Other users may be able to modify certain areas of the network equipment, but cannot change other accounts or security features.

For the actual network traffic itself, we first determine the level of default access. For many client sites, we allow any devices on the network to have access as there’s a limit to what we, as a third-party, can limit. Other areas with more sensitive information limit access to known devices through 1) disabling DHCP, 2) setting up an Access Control List to only allow certain devices to connect (after being set Static IP settings, of course).

The traffic itself is then divided into Zones, depending on where it’s physically or logically connected, and what it should be connecting to. We restrict access between Zones by default and only whitelist traffic specifically via ACL. For example, security cameras need network access, but the access doesn’t need to be complete. We limit traffic to those who must have access to the cameras and block all the rest.

We also place Guest traffic in an untrusted zone that is isolated from everything else. Hyper-sensitive devices, like credit cards, are placed in a highly-restricted zone that is heavily locked down to the bare minimum methods needed.

Finally, even the traffic itself is regulated. Since we use Next-Generation Firewalls (NGFW), we can inspect every packet to determine exactly what its purpose is, and can limit network access not only be source & destination IP, but by application (Microsoft SQL? Our software? Email? Facebook?) and decide if it’s allowed. We can also add features that will reject traffic if the remote destination fails an SSL inspection, and we have features that will block traffic if it resembles a malicious actor. We can also limit traffic based on the country of destination, or limit it to specific websites and domains (either via IP or FQDN).

These are just some of the methods we use to secure the actual network traffic, in addition to access to the network management itself, discussed in another post.