Rogue devices.
One of the things you have to be concerned about
on your network are rogue devices.
Now, anytime a device is connected to your network,
these network devices are identified
using the hardware interface MAC address,
and their IP address.
So if I connect my smartphone to the network,
or I connect a laptop to the network or smart TV,
all of these devices,
if they have a network card,
have a MAC address and will hopefully
be assigned an IP address.
When that happens, you can use that
to identify these devices across your network.
Now, if you want to prevent things from connecting
to your network that aren't authorized,
one of the best mitigations you can use is
to use digital certificates on those endpoints
and servers, forcing them to authenticate
and encrypt traffic using IPSec or HTTPS.
This will make sure that only devices you authorize
will get onto your network.
Now, if you get an unauthorized device on your network,
this is known as a rogue device,
and that's what we're going to focus on inside of this lesson.
Now, when we talk about rogue devices,
these are any unauthorized device
or service such as a wireless access point, a DHCP server,
or a DNS server that's on a corporate
or private network that allows unauthorized individuals
to connect to that network.
Now, most often people think of rogue devices
as things like a wireless access point or a switch
or a hub that's being added,
but they actually include much more than that.
For example, if I have this thumb drive
and I stick it into a server, is that a rogue device?
Well, yes it is,
because that thumb drive could be attached to the server
to download sensitive data.
It's something that is not authorized
and it's being connected to my network
through that workstation or through that server.
And so this is an idea that you have to think about
as well when you start talking about rogue devices.
One of the most important things to do
with rogue devices is detect them,
because if you identify these things,
you can then remove them.
So rogue system detection is simply a process of identifying
and removing machines on the network that are not supposed
to be there.
So for the rest of this lesson,
we are going to talk about rogue systems.
We need to figure out first
what is considered a rogue system.
Well, there's lots of them out there.
We have network taps and wireless access points, or WAPs.
We have servers, we have wired and wireless clients.
We have software that's installed without our permission.
We have virtual machines and we have smart appliances.
All of these things can be rogue devices or rogue systems.
Now, one of our jobs is to identify everything
that's on our network and identify what shouldn't be there.
Based on that,
we can then go through this rogue device system detection,
find out what's not supposed to be there
and get it off our network.
So let's talk about all
of these different categories of rogue devices.
First, we have network taps.
Now a network tap is a physical device
that is attached to cabling
to record packets
that are passing over that network segment.
We talked about network taps earlier in this course
because we use them as cybersecurity analysts.
We want network taps that are in our control
so we can collect information
and detect things on our network by looking through
all of our packet captures and network flows.
But we don't want a rogue network tap
that is under the control of some adversary,
and that's what we're talking about here with network taps.
The next area is wireless access points or WAPs.
Now these are different devices that can be connected
to your network and they extend your physical network
into the wireless spectrum.
Now, there's lots of problems when you start dealing
with wireless access points,
especially ones you don't control.
One of them is that there can be rogue access points
on your network.
Now, there's two ways of looking at this.
One is you have a rogue access point that's connected
to your network,
which can allow an adversary to connect
to their wireless access point
and then convert their radio signal from the parking lot
going into your access point into the physical network
over your ethernet network.
Now, the other type of rogue access point we can have is
where an attacker gets close to you
and then sets up their own access point
with its own connection to the internet.
Now, that point isn't going to actually connect
to your network,
but it can be used as an evil twin
and make it look like it's part of your network.
So for example,
if I set up a rogue access point
in the middle of Starbucks and you try to connect
to the Starbucks wifi,
you may be connecting to the Starbucks wifi
or you may be connecting to mine.
If you're connecting to mine,
I now can capture all your traffic and put you at risk.
We want to make sure this doesn't happen,
and so we're going to scan our airwaves
and find out what wireless networks are near us,
identify those rogue devices and get them taken down.
Now, often students ask me,
how hard is it to create one of these rogue access points?
Well, if you have something like a wifi pineapple,
you can easily create a rogue access point
for all those unsuspecting users.
The next type of rogue device we're going to talk about
is a server.
Now, an adversary may try to set up a server as a honeypot
to start harvesting network credentials or other data.
By doing this, they can then be another server
on your network and try to trick your users
into giving them critical information.
They could also use things like ARP poisoning
or corrupting name resolution to be able
to divert traffic into their server instead of yours.
So you want to make sure you're identifying
these rogue servers and get them off your network.
Another type of rogue device you might have
is a wired or wireless client.
For example, if somebody brings in their personal laptop,
takes out the connection from their work laptop
and plugs it into their personal laptop,
they have now added a rogue device,
their personal laptop, to your organizational network.
This can be a big problem
because these are devices you don't control.
They have webcams on them, which can see inside the room.
They have microphones to record conversations.
They might bring malware into your network.
Lots of different things can happen when you don't control
the device.
In an organization,
if you're using a bring your own device policy,
this would not be considered a rogue device
because you're allowed to bring them in under that policy.
But in most organizations,
if you don't have a bring your own device policy,
bringing your own personal laptop
is not going to be authorized,
and it would be considered a rogue device.
Now, another thing to think about when you talk
about authorized client devices is
that they could be used in an unauthorized way.
For example, I have a workstation in my office
that the company gives me.
I can log in there using my username and password.
All of that is authorized,
but I don't have permission to try to SSH into a server
or perform network scans or tether my smartphone to it.
All of these are things that are unauthorized.
And so if I do those things,
I now have turned that authorized client into a rogue device
because it's not following the right procedures.
The next type of thing we want to talk about is software.
And software can actually be rogue as well.
If I just go to the internet
and download a piece of software on my workstation
and install it, that can go against company policy
and it would be considered a rogue device at that point.
This can actually have things like
malicious DHCP or DNS servers.
It might be malware, it could be covert spying software.
All of these things could be installed
as part of this rogue software.
So instead, you should always install software
using the appropriate change management processes
and make sure that software is clean
and ready to go on the network.
Another type of rogue device is virtual machines.
If you're using a very highly virtualized environment,
people can start creating virtual machines
that could be used to create rogue servers and services
inside that virtualized environment.
Now, in the old days, if somebody wanted
to bring a new server into your offices,
you would probably see them carrying
this big computer and hooking it up.
But with virtual machines, it's just software code.
So if they could spin up a virtual machine
and run software to run a server on it,
that would be a way to put a rogue server in your network.
So keep that in mind as well.
The final area we want to talk about is smart appliances.
Now these are devices like printers and webcams
and VoIP handsets and VTC systems and washing machines
and refrigerators and smart TVs
and all sorts of other things.
These days, everything seems to be internet connected.
And when they're internet connected,
that means they're a potential vulnerability
that adversary could exploit.
A lot of these devices
are running Linux-based operating systems,
but they don't receive the patching
and updating like your Linux servers would.
And so they are something
that could bring vulnerabilities into your systems.
If you install a new TV in the conference room,
does that TV have wifi?
And did you plug it into the network?
Because if so, that device could be something
that could be used by an attacker against you.
So now that we've talked about all the different kinds
of rogue devices,
and I told you all the bad news out there,
how can you figure out what rogue devices
there are and how do you detect them?
Well, we could perform rogue device detection
in lots of different ways.
One of them is by doing a visual inspection
of ports and switches,
especially if you're dealing with wired networks.
This is one of the best ways to find rogue devices.
Now, when you're conducting your physical inspection,
you want to make sure that you're careful
to ensure the attacker didn't install some additional piece
of equipment or counterfeit equipment with fake asset tags.
For instance, if you have a rack of a bunch of Cisco gear
and somebody brings in another device
that looks like a Cisco device
and you had five there yesterday
and now you have six, will you be aware of that?
Will you see it as you walk in on a daily basis?
Well, if you had five and six, you might,
but if you had 50 and now you have 51, you might not.
And so this is something to keep in mind
as you're looking at things.
As you go through,
you should do inventories either monthly
or quarterly to see all the devices
that you expect are there and no additional devices.
Another detection mechanism for rogue devices is
to conduct network mapping and host discovery.
You can use an enumeration scanner
to help identify hosts via banner grabbing
and fingerprinting of those devices across your network.
As you start running scans across your network
and performing this enumeration,
you'll start figuring out exactly what's on your network.
You've got 10 Linux servers and they're this version.
You've got five Windows 2019 servers,
whatever those things are.
This will help you do that.
And if you know what your baseline is
and you write another scan
and now you have three new servers,
you can then figure out
why do you have those three new servers?
'Cause if they didn't go through
the proper change control process,
they would be rogue devices.
If you're worried about wireless devices,
you can conduct wireless monitoring.
This is also known as wireless sniffing and discovery.
And this can be used to find unknown
or unidentifiable service set indicators
or SSIDs showing up within the range of your office.
So again, if you have an office
and the name was Dion Training as your wifi,
and right next door is a coffee shop
and somebody sets up a rogue access point
called Dion Training,
and you start seeing there is three different signals
coming out from Dion Training,
but you only have two in your office, well,
that would be a rogue device.
And wireless monitoring can help you figure that out.
Another good detection mechanism is to use packet sniffing
and traffic flows.
This can be used to identify any unauthorized protocols
that are on your network or any unusual
peer-to-peer communication flows.
For example,
if you're not running any web servers on your network,
but you start seeing port 80 is running
and sending data out,
often that could be an indication
that somebody set up a malicious
or rogue web server inside your network.
And so you want to look into that.
And finally, we have NAC and intrusion detection.
A lot of security suites and appliances
can combine automated network scanning
with defense and remediation suites to try
to prevent rogue devices from accessing the network.
If you're using NAC,
you might be using something like
usernames and passwords to gain access to the network,
or even better, digital certificates.
If somebody doesn't have that digital certificate,
that device can't get on the network.
If you're dealing with intrusion detection,
it can go and scan the network and say,
I found this new thing.
I don't know what it is, and therefore I'm going to flag it.
And that way an analyst can look into it further
and figure out if it's a rogue device.