|
Posted by Kurt on March 10, 2008, 6:16 pm
Please log in for more thread options
Two ideas to consider: IPSec - ESP or NAP. Either one would allow you to
prevent those rogues from communicating with your managed hosts. Deploying
them together provides a high level of security, but even just using IPSec -
ESP with null encryption will provide a lot of protection for your hosts.
--
Regards,
Kurt Dillard
Want some good security information? Check out some of my recent work...
. NIST Special Publication 800-28 Version 2, Guidelines on Active Content
and Mobile Code (reviewer):
http://csrc.nist.gov/publications/PubsSPs.html#800-28_Version2
. Windows Server 2008 Security Resource Kit (coauthor):
http://www.microsoft.com/MSPress/books/11841.aspx
. Windows Server 2008 Security Guide on TechNet (coauthor):
www.microsoft.com/wssg
>> > Does any vendor make an application that passively listens to all
> ethernet
>> > segments on a computer, and then notifies the administrator if any
>> > unauthorized IP or ethernet Mac address shows up on any segment? You
>> > would
>> > obviously need to feed into such an application the IPs and Mac
> addresses
>> > that are authorized for your network. But when a contractor shows up
> or
>> > someone plugs in a new computer, the administrator would know about it
> the
>> > instant it happens.
>>
>> One way I would like to address this requirement is at the
> switches/router.
>> If they were configured with the allowed hosts, perhaps something more
>> strong than just MAC/IP, and would for all other hosts send back
> indication
>> of host unreachable for TCP and also forward copy of packet on to the
> local
>> blackhole machine for all protocols.
>
> My main requirement isn't to deny access to that traffic. My main
> requirement is to get instant notification that such traffic exists. I
> want to know about the behavior of people so that I can give them feedback
> about what is acceptable and what is not. And if someone is acting
> really
> outrageously I need to address that behavior.
>
> --
> Will
>
>
| 
XML Sitemap