I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots of non-staff members that have physical access to it.
It is a HP ProCurve switch. I plan on taking the following precautions, but am looking for any loopholes I may have missed:
- Disable the physical device reset buttons on the front of the switch (in software), not with epoxy
- Disable all ports that are not in active use
- Port-based VLAN for the active ports that take them off the main network and onto a less trusted network (but cannot go to a dmz-style totally untrusted network)
- Leave two ports enabled that go immediately to a captive portal on a guest VLAN for, well, guests. (the use of these ports will be publicly documented)
- Port-based 802.1X authentication based on known MAC addresses for the active, non-guest ports
- The uplink port will use 802.1q trunking with a native VLAN that is unused.
The cabling will be static. It will virtually never change, apart from the two guest ports.
I know for a fact that due to the sort of people that come through the location that they will be curious to see what's on the switch, and I don't want them getting into the protected part of the network unless they actively attempt to subvert the security. (And if they do that, then that's a question for security.se)