Folks...
While I agree that there is a certain level of trust that needs to be allowed
your network/security
admin personnel, this doesn't mean that you can't implement logging and
monitoring to keep them
honest. This relies heavily on the idea of separation of duties, admin is one
group and monitoring
and change management should be different groups. If there are more people
involved in the monitoring
and administration then it will require some collusion of employees to defraud
the organization.
Possibly an automated login and configuration gathering tool would help you to
keep and eye on your
admin groups. The system would have to be setup to login on every X minutes to
check the
configuration against the current "known-good" config. Additionally it would
need to be monitoring
the logs from all devices and do config checks every few moments between when
an admin has logged in
and logged out (checking to see how the admin has made changes and alerting
review when they have
deviated from the approved config). Now that I say that I am not sure you can
have multiple users on
IOS logged in with access to the running config, but this sort of system would
help to solve this
particular issue....
Ramblings from a paranoid soul at 30,000 ft...
-Kyle
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of DaKahuna
Sent: Friday, October 06, 2006 7:08 PM
To: pen-test@securityfocus.com
Subject: Re: Layer 3 and Firewall
Could you be more specific on the technical solution- because that is
what I am looking for urgently? I am not worried about VLAN hopping or
any other user-inititated attack ? . I am only worried about the
switch admin playing foul.
If you can't trust your switch admin then you need to replace him
with someone you can trust.
Administrator's are people in a position that requires unequivocal
trust. In order to be effective in their jobs they need to be
privileges that go beyond those of normal users.
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
