What practices/ mechanisms/ protocols can be used to secure communication on physically exposed Ethernet links?

Question

Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any "secure" mechanisms.

Let's say despite having added "physical security" in the form of "conduits" for the cable, what if someone is able to drill or cut their way in an undetected manner and adds a listening device or MIM on it.

If crooks are ingenious enough to create ATM skimming devices that emulate the entire physical/ electronic structure & interface then I am sure someone with enough incentive can find a way to physically tap in.

Now, typically between long distance sites VPN is leveraged. What could one do in such scenarios? Do we leverage VPN for such links or are there other ways / mechanisms in tech/ protocol stack & standards?

---

Communication on a physical Ethernet link, between 2 devices:

• Typically operates at Layer 2 - Data Link layer
• Medium Access Control (MAC) uses Carrier Sense Multiple Access/ Collision Detect (CSMA/ CD) ; Wireless Networks use CSMA/ CA.

It is possible to do MAC ID spoofing as well as listen to the cross talk on an Ethernet link, so various attacks at that layer are possible as outlined below.

Let's say there is physical exposure (which cannot be physically secured) of Ethernet link passing through a public corridor between 2 offices in a building, what ways can you secure the link?

From experts on SE, What are recommended practices, mechanisms, protocols that can be leveraged/ used to secure communication on physically exposed Ethernet links?

• Mechanisms at Layer 1/2
• Mechanisms at Layer 3

http://www.sanog.org/resources/sanog7/yusuf-L2-attack-mitigation.pdf

http://www.slashroot.in/tcp-layer-2-security-threats-and-attacks

https://www.sans.org/reading-room/whitepapers/intrusion/detecting-responding-data-link-layer-attacks-33513

https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf

https://www.cisco.com/web/ME/exposaudi2009/assets/docs/layer2_attacks_and_mitigation_t.pdf

Answer 1

802.1AE is the IEEE MAC Security standard (also known as MACsec) which defines connectionless data confidentiality and integrity for media access independent protocols. It is standardized by the IEEE 802.1 working group.

(...)

The IEEE 802.1AE (MACsec) standard specifies a set of protocols to meet the security requirements for protecting data traversing Ethernet LANs. This norm assures incomplete network operations by identifying unauthorized actions on a LAN and preventing communication from them.

MACsec allows unauthorised LAN connections to be identified and excluded from communication within the network. In common with IPsec and SSL, MACsec defines a security infrastructure to provide data confidentiality, data integrity and data origin authentication.

By assuring that a frame comes from the station that claimed to send it, MACSec can mitigate attacks on Layer 2 protocols.

Answer 2

This question is almost too broad to be on-topic here.

Layer-1 is the physical layer, your first defense. Using conduit or ducting is a layer-1 defense, as well as a policy which requires any switch ports that are not currently used to be disabled, ensuring that unused network cables are not cross-connected in the data closet, and limiting access to data closets and other area where the physical network is exposed.

If you want a standard for layer-2 authentication, it's 802.1X, although it is becoming easier by the day to bypass it (see Bridge Too Far), and 802.1AE, which extends 802.1X with MKA (MACsec Key Agreement) for authentication and encryption. There are entire books (e.g. from Cisco Press: LAN Switch Security: What Hackers Know About Your Switches, by Eric Vyncke, Christopher Paggen) about LAN security. Port security on switches can be set up to only allow a single (or limited number of) MAC address at any given time, or in any given time period, to prevent connection of hubs, switches, APs, etc., including a port disable (requiring manual intervention or for a given time period) if violations are detected (care needs to be taken for things like VoIP phones where PCs are connected to the phone since the phone itself will have one or more MAC addresses). Disable most layer-2 protocols (e.g. CDP/LLDP, DTP, PAgP/LACP, VTP, etc.) since they are vulnerable to attack. Specifically limit VLANs on trunks (manually prune VLANs). Use DHCP Snooping in conjunction with Dynamic ARP Inspection and IP Source Guard. And much, much more.

For a layer-3, standards-based solution, which can be used alone or combined with others, IPsec was developed for IPv6, but later retrofitted to include both IPv4 and IPv6 in RFC 1825, Security Architecture for the Internet Protocol and its replacements, RFC 2401 and RFC 4301, and various extension and modification RFCs.

Beyond layer-3, you get into a bunch of application-layer authentication methods (e.g. SSL), but you only asked about security up to layer-3, and applications and application-layer protocols are off-topic here.

Security should use a layered approach, and you need to balance the cost (not only direct cost, but other factors, e.g. time, business disruption, etc., too) to the level of risk you are willing to tolerate. Determine if the cost to implement a security method, and compare it to the risk involved. You will never be 100% secure, but you can make it so difficult that only the most determined intruders will get it, so you try to make it not worth their time and efforts. For example, would you go to great time and effort to break into a network to get a simple calculator application, even if it is much better than the Windows calculator? It may be worth it if the calculator has a proprietary calculation that is worth millions of dollars.

Auditors will often be satisfied that you have identified and rated a security risk, but you have not remediated it, if you can show that the remediation is more expensive than the risk involved. For example (don't depend on this if you are really building), building in a 100-year flood plain, where there is a 1% chance (each year) that that a flood will destroy your building, you don't need flood insurance, while building in a 10-year flood plain, where there is a 10% chance (each year) that a flood will destroy your building, requires flood insurance. Something like an almost bullet-proof physical security can mitigate the need for advanced layer-2 security (e.g. 802.1x), if the cost for implementing the layer-2 security is high (e.g. 802.1x requires an infrastructure, and it is often disruptive to the business).

Answer 3

Authenticate one another then scramble the communications crossing that link, i.e., use IPSec.

Internet Protocol Security (IPsec) is a protocol suite for secure Internet Protocol (IP) communications that works by authenticating and encrypting each IP packet of a communication session. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.

IPsec can be used in protecting data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection.

Wikipedia