4

Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any "secure" mechanisms.

Let's say despite having added "physical security" in the form of "conduits" for the cable, what if someone is able to drill or cut their way in an undetected manner and adds a listening device or MIM on it.

If crooks are ingenious enough to create ATM skimming devices that emulate the entire physical/ electronic structure & interface then I am sure someone with enough incentive can find a way to physically tap in.

Now, typically between long distance sites VPN is leveraged. What could one do in such scenarios? Do we leverage VPN for such links or are there other ways / mechanisms in tech/ protocol stack & standards?


Communication on a physical Ethernet link, between 2 devices:

  • Typically operates at Layer 2 - Data Link layer
  • Medium Access Control (MAC) uses Carrier Sense Multiple Access/ Collision Detect (CSMA/ CD) ; Wireless Networks use CSMA/ CA.

It is possible to do MAC ID spoofing as well as listen to the cross talk on an Ethernet link, so various attacks at that layer are possible as outlined below.

Let's say there is physical exposure (which cannot be physically secured) of Ethernet link passing through a public corridor between 2 offices in a building, what ways can you secure the link?

From experts on SE, What are recommended practices, mechanisms, protocols that can be leveraged/ used to secure communication on physically exposed Ethernet links?

  • Mechanisms at Layer 1/2
  • Mechanisms at Layer 3

http://www.sanog.org/resources/sanog7/yusuf-L2-attack-mitigation.pdf

http://www.slashroot.in/tcp-layer-2-security-threats-and-attacks

https://www.sans.org/reading-room/whitepapers/intrusion/detecting-responding-data-link-layer-attacks-33513

https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf

https://www.cisco.com/web/ME/exposaudi2009/assets/docs/layer2_attacks_and_mitigation_t.pdf

  • Possible duplicate of How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?. You could also run the cabling in conduit if you are worried that someone will cut the cable and re-terminate it for access. – Ron Maupin Apr 11 '16 at 11:55
  • some part(s) of this might be on topic here. As it is, it's partly a dupe (as above), partly off-topic (eg, all product recommendations are off-topic here), so I'll close this as "too broad" ;) – Craig Constantine Apr 11 '16 at 23:04
  • @RonMaupin - Let's assume that physical intrusion has happened or is possible without conduit or inspite of conduit. What "networking" related mechanisms/ technologies can we leverage? – Alex S Apr 12 '16 at 9:17
  • @CraigConstantine - Not asking for product recommendations - Security mechanisms - Standards, Protocols etc. just the way 802.3 is a standard, VPN/ SSH/ SSL are used stuff. - For e.g. When we are outside on untrusted networks we use VPNs. When using WiFi we use WPA2-PSK now as WEP is not as secure. So, ideas in that direction – Alex S Apr 12 '16 at 9:19
  • Let say someone/ device is just listening passively or as a MIM. What mechanisms exist that can be leveraged? PS: I'll go through the suggested dup link and see if there's overlap. – Alex S Apr 12 '16 at 9:20
3

802.1AE is the IEEE MAC Security standard (also known as MACsec) which defines connectionless data confidentiality and integrity for media access independent protocols. It is standardized by the IEEE 802.1 working group.

(...)

The IEEE 802.1AE (MACsec) standard specifies a set of protocols to meet the security requirements for protecting data traversing Ethernet LANs. This norm assures incomplete network operations by identifying unauthorized actions on a LAN and preventing communication from them.

MACsec allows unauthorised LAN connections to be identified and excluded from communication within the network. In common with IPsec and SSL, MACsec defines a security infrastructure to provide data confidentiality, data integrity and data origin authentication.

By assuring that a frame comes from the station that claimed to send it, MACSec can mitigate attacks on Layer 2 protocols.

| improve this answer | |
2

This question is almost too broad to be on-topic here.

Layer-1 is the physical layer, your first defense. Using conduit or ducting is a layer-1 defense, as well as a policy which requires any switch ports that are not currently used to be disabled, ensuring that unused network cables are not cross-connected in the data closet, and limiting access to data closets and other area where the physical network is exposed.

If you want a standard for layer-2 authentication, it's 802.1X, although it is becoming easier by the day to bypass it (see Bridge Too Far), and 802.1AE, which extends 802.1X with MKA (MACsec Key Agreement) for authentication and encryption. There are entire books (e.g. from Cisco Press: LAN Switch Security: What Hackers Know About Your Switches, by Eric Vyncke, Christopher Paggen) about LAN security. Port security on switches can be set up to only allow a single (or limited number of) MAC address at any given time, or in any given time period, to prevent connection of hubs, switches, APs, etc., including a port disable (requiring manual intervention or for a given time period) if violations are detected (care needs to be taken for things like VoIP phones where PCs are connected to the phone since the phone itself will have one or more MAC addresses). Disable most layer-2 protocols (e.g. CDP/LLDP, DTP, PAgP/LACP, VTP, etc.) since they are vulnerable to attack. Specifically limit VLANs on trunks (manually prune VLANs). Use DHCP Snooping in conjunction with Dynamic ARP Inspection and IP Source Guard. And much, much more.

For a layer-3, standards-based solution, which can be used alone or combined with others, IPsec was developed for IPv6, but later retrofitted to include both IPv4 and IPv6 in RFC 1825, Security Architecture for the Internet Protocol and its replacements, RFC 2401 and RFC 4301, and various extension and modification RFCs.

Beyond layer-3, you get into a bunch of application-layer authentication methods (e.g. SSL), but you only asked about security up to layer-3, and applications and application-layer protocols are off-topic here.

Security should use a layered approach, and you need to balance the cost (not only direct cost, but other factors, e.g. time, business disruption, etc., too) to the level of risk you are willing to tolerate. Determine if the cost to implement a security method, and compare it to the risk involved. You will never be 100% secure, but you can make it so difficult that only the most determined intruders will get it, so you try to make it not worth their time and efforts. For example, would you go to great time and effort to break into a network to get a simple calculator application, even if it is much better than the Windows calculator? It may be worth it if the calculator has a proprietary calculation that is worth millions of dollars.

Auditors will often be satisfied that you have identified and rated a security risk, but you have not remediated it, if you can show that the remediation is more expensive than the risk involved. For example (don't depend on this if you are really building), building in a 100-year flood plain, where there is a 1% chance (each year) that that a flood will destroy your building, you don't need flood insurance, while building in a 10-year flood plain, where there is a 10% chance (each year) that a flood will destroy your building, requires flood insurance. Something like an almost bullet-proof physical security can mitigate the need for advanced layer-2 security (e.g. 802.1x), if the cost for implementing the layer-2 security is high (e.g. 802.1x requires an infrastructure, and it is often disruptive to the business).

| improve this answer | |
  • Ron Maupin - Thanks for the layered approach here. 2. I was not aware of the layer 2 auth MacSec thing. But really great insights and I will read the links. I guess such an intrusion would kind of be at layer 2. I was aware of the some of the approaches on higher layers, but got me thinking; we worry about WiFi intrusion but what if someone spliced a wire. 3. I guess the way to go for such links would be to add more security to the higher layers.. as you've suggested. Albeit similar to adding a VPN etc despite having WPA2, just in case someone is sniffing WiFi packets in medium {air} around – Alex S Apr 12 '16 at 17:36
  • More clearly your answer outlines that the lower layers did not have much in terms of security, but the higher layers are where we compensate for this design. – Alex S Apr 12 '16 at 17:41
  • @AlexS, you specifically asked about ethernet, but WPA2 is a Wi-Fi, not ethernet, protocol. Ethernet and Wi-Fi are two completely different protocols, both at layer-1 and layer-2. Just like troubleshooting, you should start with layer-1, then layer-2, than layer-3, etc. when securing your network. Securing the lower layers may mitigate, or even obviate, the need for securing the upper layers (if your physical layer is completely secure, it is much less important to use layer-2 security, since layer-2 is mostly protected by the layer-1 security). – Ron Maupin Apr 12 '16 at 17:46
  • Yes, I am aware they are different and of the finder details of WiFi {CSMA/CA} & Ethernet {CSMA/CD} & how their frames, bytes, headers & rollbacks operate - Got a masters in that space.. Just been out of touch, hence the question. :) I apprecate your answer. – Alex S Apr 12 '16 at 18:40
1

Authenticate one another then scramble the communications crossing that link, i.e., use IPSec.

Internet Protocol Security (IPsec) is a protocol suite for secure Internet Protocol (IP) communications that works by authenticating and encrypting each IP packet of a communication session. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.

IPsec can be used in protecting data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). Internet Protocol security (IPsec) uses cryptographic security services to protect communications over Internet Protocol (IP) networks. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection.

Wikipedia

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.