关于作者
乔恩·格林is the Chief Security Officer for Aruba, a Hewlett Packard Enterprise company. He is responsible for overseeing all aspects of information and product security as well as guiding the strategic...
全文
大多数组织锁定Wi-Fi访问权限，但依靠物理安全性和静态细分作为有线网络的主要防御技术。该博客是三部分系列中的第一个，试图发现为什么这种做法在当今很普遍以及存在哪些选择。
首先，让我告诉您与客户交谈时经常出现的情况：
“我想要在你的建筑。对end of lunchtime, I find a group of employees returning to the office and walk with them. I’m wearing a badge that looks just like your company badge. I’m carrying a package in one hand and talking on a cellphone with my other hand. Will the employees hold the door open for me?”
在大多数情况下，答案是肯定的。在某些时候，我听到一个关于旋转门或其他单人访问控制方法的故事，并保证该计划永远不会起作用。我将其留下来：坐在Defcon的社会工程村，或参加红色团队或笔测试员会议，并聆听人们甚至在一些最安全的空间中努力工作的各种方式。令人着迷。
我为什么要提起这个？因为尽管他们花了15年以上的时间锁定Wi-Fi访问，但大多数组织继续依靠物理安全性和每个端口细分作为有线网络的主要防御技术。如果您可以找到端口，则可以连接。而且，如果您可以找到一个未使用的端口，则需要几秒钟即可安装连接到该端口的远程访问设备，让您进入几分钟之内。我的兄弟在一家知名科技公司的身体安全方面工作，我曾经问过他：“如果您在建筑物中走来走去，遇到一个插入网络港口的小白盒，您会怎么做？”他的回答并不令我惊讶：“我可能认为它应该在那里，并继续前进。”
随着当今的高级威胁通过网络钓鱼电子邮件和恶意软件传播，问题将扩展到您自己的员工或承包商进入环境并出于正当原因而插入的承包商。授予这些人的物理访问，实际上，在某些情况下，他们被允许以其业务目的连接到有线网络。恶意软件可能会在其设备上徘徊，等待网络访问以找到渗透的方法。
基于端口的安全已不够
在大多数环境中，当前状态是，一旦某人连接到有线网络，访问控制（如果完全存在）似乎主要基于端口。您插入的端口决定了您的VLAN，最终决定了您的交通经过的上游防火墙策略或ACL。许多组织采用除防火墙以外的各种不同工具，以帮助检测和防止网络上可能存在的威胁，从端点检测和响应（EDR）到入侵预防系统（IPS）到下一代AI/ML基于AI/ML的工具。问题是所有这些检测/响应都开始aftera device or user has already connected and has been granted some level of access for some period of time. Most, if not all, of the security apparatus is multiple hops away from where the users and devices are connected, creating blind spots in visibility and control that are rather significant. Add to this the tremendous operational burden of all the manual moves, adds, and changes of ACLs and VLANs when a user or device gets moved to a different port. Isn’t there a better way?
随着当今的高级威胁和对手掩盖其活动作为正常的用户/设备行为，并且随着社会工程的持续威胁，我们必须怀疑在安全设备检测并阻止威胁之前，那个坏演员能够完成多少。请记住，平均威胁时间在100天以上的范围内（取决于您阅读的研究），这是给予对手和责备的一部分的绳索网络的内部。必须为安全团队提供一定程度的知名度和控制权，以通过更快地检测和删除它们来帮助应对这些威胁，甚至在某些情况下甚至在它们传播之前阻止它们。
Why Do Wired Networks Remain Open?
I am sure many of you already understand this concern. So why is it that wired networks remain this open? Through discussions with many customers it seems the concern is the operational and user related complexities and cost with implementing an access control solution on the wired network. The concern is centered around putting added complexity on the users to navigate a security policy which then leads to added operational burden to troubleshoot those issues. Also, on the operational side are the questions around the unknown: If technologies like RADIUS authentication are not already leveraged or enabled on the wired network, and the wired network is operating just fine, what operational impact would it have by turning on more functionality?
These are all valid concerns, but concerns that have solutions.
In my next blog, I’ll present why organizations must implement stronger pre-connect controls and segmentation on the wired network to mitigate the risk of insider threat, while at the same time doing so in such a way that it is user friendly, and actually reduces the operational burden.
