Rogue Device Detection

Last Updated on Fri, 30 Jun 2023 | Network Security

No matter how well you harden the devices you know about, an intruder can introduce into your network a device of which you are unaware. These rogue devices pose a nasty security problem, particularly in larger organizations. In large organizations, it can be nearly impossible to discover that someone has inserted into the network a device designed to steal passwords, as discussed in the "Rogue Devices" section of Chapter 3, "Secure Networking Threats."

On a small network with only five hosts, however, it is fairly easy to see that there is now a sixth host on the network. If the network instead contains 10,000 hosts, all bets are off. Rogue device detection and attack mitigation boils down to a few general principles. Just don't expect to completely solve the problem if you run a large network. The main tasks are as follows:

• Authenticate valid devices Strongly authenticate all valid devices so that network resources are very limited to a rogue system. Technologies such as IEEE 802.1x and authenticated routing protocols can help make this happen. Both have a significant management penalty in large networks. IEEE 802.1x is discussed more fully in Chapter 9, "Identity Design Considerations."

• Map the network Continually map the network from multiple locations. By using freeware scanners such as Nmap or commercial products, it is possible to take a snapshot of the available systems on your network. Many of these tools include the capability to identify the remote OS. This can be a good way to identify not just rogue hosts but also rogue network devices (routers, firewalls, and so on). Unfortunately, in a large network, mapping the entire network can be problematic. It would take obvious changes to trigger something that was likely an attack. Instead, you might need to focus your mapping areas on key network areas to which you can pay more close attention (data centers and so on) and others that you map but don't track as closely.

Some organizations try to map the network by asset-tracking software tied to network login. This is a good way to track systems your IT organization supports, but a rogue device will never be checked by such a system.

• Establish strong physical security Be vigilant about physical security. Strong physical security is the most effective way to limit rouge devices. See Chapter 6 for more details.

• Consider technology-specific detection methods Some specific technologies have unique methods for detecting rogue devices. For example, wireless LAN access point (WLAN AP) devices can be detected by APTools, which is available at the following URL:

http://winfingerprint.sourceforge.net/aptools.php. WLAN APs can also be detected by roaming IEEE 802.11b scanners, which organizations use from time to time. Rogue WLAN AP detection is discussed in Chapter 11, "Supporting-Technology Design Considerations."

4 PREV

NEXT t

Continue reading here: Physical Security Issues

Was this article helpful?

0 0

Related Posts

Readers' Questions

  • caleb
    How to detect rogue devices on network?
    1 month ago
    • There are several approaches you can take to detect rogue devices on a network:
    1. Network monitoring tools: Use network monitoring tools like Wireshark, Nagios, or PRTG that can analyze network traffic and provide details about connected devices. Look for any unfamiliar or unauthorized devices that are connected to the network.
    2. DHCP server logs: Check the logs of your Dynamic Host Configuration Protocol (DHCP) server, which assigns IP addresses to devices on the network. Look for any unrecognized or unauthorized IP addresses.
    3. ARP table inspection: Use the Address Resolution Protocol (ARP) table on your router or switch to inspect the MAC addresses of connected devices. Compare the list of MAC addresses with authorized devices and look for any discrepancies.
    4. Port scanning: Conduct regular port scans of your network to identify any open ports or services that are not authorized. Rogue devices often create unauthorized services or open ports for malicious activities.
    5. Wireless network monitoring: If you have a wireless network, use wireless network monitoring tools like Airodump-ng (for Linux) or inSSIDer (for Windows) to scan for unauthorized wireless access points or devices.
    6. Network Access Control (NAC): Deploy a Network Access Control system to ensure that only authorized devices can connect to the network. NAC solutions can perform pre-authentication checks to verify the identity and security posture of connecting devices.
    7. Regular network audits: Conduct regular network audits to keep track of authorized devices and compare them with the devices currently connected to the network. Any unknown or unauthorized devices should be investigated.
    8. Physical inspection: Physically inspect your network infrastructure, such as switches, routers, and access points, to ensure that no unauthorized devices have been physically connected.Remember, detecting rogue devices is only the first step. Once you identify them, you should investigate further to determine if they pose a security threat and take appropriate action to mitigate the risk.