In theory, securing wired should be no different from securing wireless. Wired connectivity should be covered by the same consistent access policies afforded to mobility projects. Mobility, after all, is simply \u201cme, getting my stuff,\u201dit\u2019s just that this time I\u2019m getting that stuff via the wire rather than wireless. So\u2026that\u2019s that solved, let\u2019s move on, shall we!<\/p>\n
Actually, no, not so fast! The trouble is that the wire has always worked, instantly \u2013 and we don\u2019t like to mess with that. In fact, if at all possible we would rather not touch it, let it fall apart dramatically \u2013 or worse we have the CLI jockeys riding roughshod over our switch configurations for the next few months. Not only that but 802.1x is really complicated, and I\u2019ve heard it requires separate supplicants for LAN adaptors. Maybe ignore the last part, I clearly conveniently forgot the last 13 years of pain since Win2K SP4 was released. Regardless, you probably get the point\u2026 We will, however, do anything to avoid actively securing access to the wired network \u2013 even though it\u2019s vital that we do as it has been left wide open for far too long.<\/p>\n
Those that know me, well professionally at least, will know that I often persist in boring them about the importance of remembering that AAA isn\u2019t just Authentication, but also, more importantly, Authorization and Accounting for everything at the end. Well, for all my fanaticism about the latter two A\u2019s, it\u2019s important to remember that most people are currently skipping all of the A\u2019s entirely \u2013 so it\u2019s the best break up the journey into separate A roads for everyone\u2019s comfort!<\/p>\n
Whilst in the distance we can see active authorization rules composed of dynamic VLANs and downloadable ACLs, with event-driven rules changes and the sharing of security context with third-party solutions \u2013 we\u2019re just dreamers in many people\u2019s eyes, so let\u2019s focus on what first steps we need to address. What do we need to know? Gather evidence of what\u2019s trying to connect and connected, classify the unknowns and verify the knowns. We also need to define a process for what happens when devices are unknown but actually need to connect \u2013 do we have a break-glass procedure? While we\u2019re talking of failure \u2013 what\u2019s our back-up in case the AAA service fails entirely?<\/p>\n
Only after these become clear can we even begin to take the first \u201cA\u201d road to Control\u2026and at least Authenticate all devices to the network. Taking small steps to secure the currently open network is still a far better option than being overwhelmed by the total journey and doing nothing at all\u2026<\/p>\n