Thanks for all of your responses....most were thoughtful and
considered. Here are some issues/concerns addressed by some of you and
my responses: (the quotes are for effect, and not totally accurate)
1. "You are trying to use DHCP to fix a management problem".
Absolutely! I'm trying to bridge the gap between policy and actual
implementation. We already have policies, but they are not enforced
and do not reflect the actual production environment. Having a
centralized method to track every thing that is added to the network
then allows for the beginings of security. For the InfoSecurity office
to work, it must be made aware of new items added to the network, this
is a process that forces anything to go through InfoSecurity right from
the start.
2. "What you are proposing is un-manageable, you will be the
bottleneck for everyone"
Two things. As I have stated in my original post, my enviroment does
not change very often (still have tokenring at some locations).
Secondly I didn't elaborate on my master plan for implementation.
I want to get the Lotus Notes guys to help me build my database so that
it is web-enabled. You are a PC tech about to deploy a PC, you go to
ip.company.com (internal, secure website). You follow some drop down
menus to choose region, location, floor to get the next IP address.
You fill out the required information (user, inventory number, OS,
virus.....) Through the magic of work-flow, your taking of an IP
address triggers an email to the security office, who then review and
audits what has happened (probably a weekly process). The PC tech that
is not complying with the information gathering request or is not
accurate in the information produced gets some form of remediation.
3. "Someone with basic knowledge will pick the next address, and cause
an IP conflict"
Once the system is in place, I will have the ability to then track what
is happening at the branch locations, to include the presence of a new
un-assigned IP address. My plan to do this is using automated scripts
that pull information from branch routers that can then look for
anomalies. Once the conversion happens at a branch, I establish my
baseline mapping MACs to IPs and compare daily/hourly/weekly scripts
against that baseline. If an IP conflict does happen and my stuff
doesn't catch it, it will generate a help desk call which will lead to
the identification of the problem and some form of remediation for the
user who caused the problem. (Something they were not supposed to be
doing due to existing policies).
4. "What you are doing is worthless, MAC spoofing gets around it"
I understand that this does not solve the MAC spoofing problem. Some
day I hope to implement 802.1x port based authentication, but that
requires hardware that I don't have right now. I do believe that MAC
spoofing is a more advanced concept and most users would make the leap
that using such tools is in serious violation of our "computing
polcies". My plan will allow me to target the people that bring in
equipment to by-pass our system security settings and people who allow
un-authorized guest connections to our internal LAN.
5. "Your gonna screw yourself if you have to make DNS/Gateway changes
manually"
I have difficulty seeing how this is a problem for two reasons. First
we have redundant DNS servers, and if one dies the IP will remain while
the server gets rebuilt. Secondly, once we have accounted for all the
PCs at a branch, we can proceed with installing our remote management
agent which will allow us to change whatever has to change remotely.
We also have the ability to alter system settings via login scripts if
needed. Interestingly, the other person to support my idea is the guy
in charge of client PC computing. His department will have to deal
with the brunt of the work to make this happen, but he sees the benefit
of having a thorough account of what is out there.
I think I have to stress that what I am proposing is more a way to
force the intergration of the InfoSecurity office to the Network
Engineering and Client support offices. The seperation of powers of
these offices makes sense, but truth be told the security office is the
only one that has mapped out procedures and actually has the
consistency checks in place to be accountable. However much work has
to happen initially, I really think this process will make a difference
in our overall security/management plan.
thanks again for all your responses.
---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
