Re: Layer 3 and Firewall

["FITNC--Kelvin Tarver" <ktarver () fitnc com>]

As part of a complete secuity policy/setup, you must have a way of controlling even the switch admins privilege and 
have away to hold him accountable.

There are a few option you want to explore depending on the switch you have and your companies security policy.

One example is AAA used with Cisco's switches which requires the admin to use a username/password to login. You can use 
a tacac or radius server to help administer this.

 With this you can restrict their rights to a few configs, log any changes made, etc.  

There are plent of similar option out there but at some piont you will have to trust someone (example the tacac/radius 
admin).

That may very well be you.  Controlling the tacac/radius server canbe a very good optio toconsider.  It all depends.

Hope this was helpful.

Kelvin Tarver
Flexible IT Network Consultant, Inc.
"Making Technology work for you!"
(718) 363-2577

Sent from my BlackBerry® wireless device      

-----Original Message-----
From: Rocky <pixscreenpoint () gmail com>
Date: Tue, 24 Oct 2006 16:37:21 
To:DaKahuna <da.kahuna () gmail com>
Cc:pen-test () securityfocus com
Subject: Re: Layer 3 and Firewall

another paranoid manager hehehe



On 10/6/06, DaKahuna <da.kahuna () gmail com> wrote:
> > Could you be more specific on the technical solution- because that is
> > what I am looking for urgently? I am not worried about VLAN hopping or
> > any other user-inititated attack ? . I am only worried about the
> > switch admin playing foul.
>
> If you can't trust your switch admin then you need to replace him
> with someone you can trust.
> Administrator's are people in a position that requires unequivocal
> trust. In order to be effective in their jobs they need to be
> privileges that go beyond those of normal users.
>
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------