1 1 00:00:00,000 --> 00:00:01,980 Rogue devices. 2 2 00:00:01,980 --> 00:00:03,420 One of the things you have to be concerned 3 3 00:00:03,420 --> 00:00:06,330 about on your network are rogue devices. 4 4 00:00:06,330 --> 00:00:08,670 Now, anytime a device is connected to your network, 5 5 00:00:08,670 --> 00:00:10,950 these network devices are identified using the 6 6 00:00:10,950 --> 00:00:14,460 hardware interface MAC address and their IP address. 7 7 00:00:14,460 --> 00:00:16,350 So if I connect my smartphone to the network 8 8 00:00:16,350 --> 00:00:19,320 or I connect a laptop to the network or a smart TV, 9 9 00:00:19,320 --> 00:00:21,570 all of these devices if they have a network card, 10 10 00:00:21,570 --> 00:00:23,970 have a MAC address and will hopefully be assigned 11 11 00:00:23,970 --> 00:00:25,290 an IP address. 12 12 00:00:25,290 --> 00:00:27,420 When that happens you can use that to identify 13 13 00:00:27,420 --> 00:00:29,850 these devices across your network. 14 14 00:00:29,850 --> 00:00:31,770 Now, if you want to prevent things from connecting 15 15 00:00:31,770 --> 00:00:33,450 to your network that aren't authorized, 16 16 00:00:33,450 --> 00:00:35,670 one of the best mitigations you can use is 17 17 00:00:35,670 --> 00:00:38,760 to use digital certificates on those endpoints and servers, 18 18 00:00:38,760 --> 00:00:40,320 forcing them to authenticate 19 19 00:00:40,320 --> 00:00:44,280 and encrypt traffic using IPSec or HTTPS. 20 20 00:00:44,280 --> 00:00:46,830 This will make sure that only devices you authorize 21 21 00:00:46,830 --> 00:00:48,330 will get onto your network. 22 22 00:00:48,330 --> 00:00:50,850 Now, if you get an unauthorized device on your network, 23 23 00:00:50,850 --> 00:00:52,890 this is known as a rogue device 24 24 00:00:52,890 --> 00:00:56,220 and that's what we're going to focus on inside of this lesson. 25 25 00:00:56,220 --> 00:00:58,020 Now, when we talk about rogue devices 26 26 00:00:58,020 --> 00:01:00,570 these are any unauthorized device or service, 27 27 00:01:00,570 --> 00:01:03,630 such as a wireless access point, a DHCP server, 28 28 00:01:03,630 --> 00:01:06,810 or a DNS server that's on a corporate or private network 29 29 00:01:06,810 --> 00:01:08,400 that allows unauthorized individuals 30 30 00:01:08,400 --> 00:01:09,930 to connect to that network. 31 31 00:01:09,930 --> 00:01:12,300 Now, most often people think of rogue devices 32 32 00:01:12,300 --> 00:01:14,130 as things like a wireless access point, 33 33 00:01:14,130 --> 00:01:16,350 or a switch, or a hub that's being added, 34 34 00:01:16,350 --> 00:01:19,200 but they actually include much more than that. 35 35 00:01:19,200 --> 00:01:21,390 For example, if I have this thumb drive 36 36 00:01:21,390 --> 00:01:24,720 and I stick it into a server, is that a rogue device? 37 37 00:01:24,720 --> 00:01:27,720 Well, yes it is because that thumb drive could be attached 38 38 00:01:27,720 --> 00:01:30,210 to the server to download sensitive data. 39 39 00:01:30,210 --> 00:01:31,950 It's something that is not authorized 40 40 00:01:31,950 --> 00:01:33,450 and it's being connected to my network 41 41 00:01:33,450 --> 00:01:35,700 through that workstation or through that server. 42 42 00:01:35,700 --> 00:01:37,650 And so this is an idea that you have to think about as well 43 43 00:01:37,650 --> 00:01:40,050 when you start talking about rogue devices. 44 44 00:01:40,050 --> 00:01:41,490 One of the most important things to do 45 45 00:01:41,490 --> 00:01:43,200 with rogue devices is detect them, 46 46 00:01:43,200 --> 00:01:45,000 because if you identify these things 47 47 00:01:45,000 --> 00:01:46,410 you can then remove them. 48 48 00:01:46,410 --> 00:01:49,020 So rogue system detection is simply a process 49 49 00:01:49,020 --> 00:01:51,780 of identifying and removing machines on the network 50 50 00:01:51,780 --> 00:01:53,640 that are not supposed to be there. 51 51 00:01:53,640 --> 00:01:55,140 So for the rest of this lesson, 52 52 00:01:55,140 --> 00:01:57,510 we are going to talk about rogue systems. 53 53 00:01:57,510 --> 00:01:59,670 We need to figure out first what is considered 54 54 00:01:59,670 --> 00:02:00,900 a rogue system. 55 55 00:02:00,900 --> 00:02:02,520 Well, there's a lot to them out there. 56 56 00:02:02,520 --> 00:02:06,090 We have network taps and wireless access points, or WAPs. 57 57 00:02:06,090 --> 00:02:08,820 We have servers, we have wired and wireless clients. 58 58 00:02:08,820 --> 00:02:11,220 We have software that's installed without our permission. 59 59 00:02:11,220 --> 00:02:14,370 We have virtual machines and we have smart appliances. 60 60 00:02:14,370 --> 00:02:18,600 All of these things can be rogue devices or rogue systems. 61 61 00:02:18,600 --> 00:02:20,790 Now, one of our jobs as a cybersecurity analyst 62 62 00:02:20,790 --> 00:02:23,040 is to identify everything that's on our network 63 63 00:02:23,040 --> 00:02:25,590 and identify what shouldn't be there. 64 64 00:02:25,590 --> 00:02:27,510 Based on that, we can then go 65 65 00:02:27,510 --> 00:02:29,790 through this rogue device system detection, 66 66 00:02:29,790 --> 00:02:31,050 find out what's not supposed to be there, 67 67 00:02:31,050 --> 00:02:33,000 and get it off our network. 68 68 00:02:33,000 --> 00:02:35,670 So let's talk about all of these different categories 69 69 00:02:35,670 --> 00:02:36,990 of rogue devices. 70 70 00:02:36,990 --> 00:02:39,000 First, we have network taps. 71 71 00:02:39,000 --> 00:02:41,730 Now a network tap is a physical device that is attached 72 72 00:02:41,730 --> 00:02:44,100 to cabling to record packets that are passing 73 73 00:02:44,100 --> 00:02:45,870 over that network segment. 74 74 00:02:45,870 --> 00:02:48,450 We talked about network taps earlier in this course 75 75 00:02:48,450 --> 00:02:50,790 because we use them as cybersecurity analysts. 76 76 00:02:50,790 --> 00:02:52,170 We want network taps that are 77 77 00:02:52,170 --> 00:02:54,480 in our control so we can collect information 78 78 00:02:54,480 --> 00:02:56,910 and detect things on our network by looking through all 79 79 00:02:56,910 --> 00:02:59,160 of our packet captures and network flows. 80 80 00:02:59,160 --> 00:03:01,440 But we don't want a road network tap 81 81 00:03:01,440 --> 00:03:03,750 that is under the control of some adversary 82 82 00:03:03,750 --> 00:03:06,240 and that's what we're talking about here with network taps. 83 83 00:03:06,240 --> 00:03:09,420 The next area is wireless access points or WAPs. 84 84 00:03:09,420 --> 00:03:11,910 Now these are different devices that can be connected 85 85 00:03:11,910 --> 00:03:14,820 to your network and they extend your physical network 86 86 00:03:14,820 --> 00:03:16,590 into the wireless spectrum. 87 87 00:03:16,590 --> 00:03:18,240 Now, there's lots of problems when you start dealing 88 88 00:03:18,240 --> 00:03:19,380 with wireless access points, 89 89 00:03:19,380 --> 00:03:21,480 especially ones you don't control. 90 90 00:03:21,480 --> 00:03:24,030 One of them is that there can be rogue access points 91 91 00:03:24,030 --> 00:03:25,320 on your network. 92 92 00:03:25,320 --> 00:03:27,570 Now, there's two ways of looking at this. 93 93 00:03:27,570 --> 00:03:30,090 One is you have a rogue access point that's connected 94 94 00:03:30,090 --> 00:03:32,400 to your network, which can allow an adversary to connect 95 95 00:03:32,400 --> 00:03:33,870 to their wireless access point 96 96 00:03:33,870 --> 00:03:35,790 and then convert their radio signal 97 97 00:03:35,790 --> 00:03:37,860 from the parking lot going into your access point 98 98 00:03:37,860 --> 00:03:41,160 into the physical network over your ethernet network. 99 99 00:03:41,160 --> 00:03:43,470 Now, the other type of rogue access point we can have 100 100 00:03:43,470 --> 00:03:45,480 is where an attacker gets close to you 101 101 00:03:45,480 --> 00:03:47,460 and then sets up their own access point 102 102 00:03:47,460 --> 00:03:49,230 with its own connection to the internet. 103 103 00:03:49,230 --> 00:03:52,050 Now, that point isn't going to actually connect to your network 104 104 00:03:52,050 --> 00:03:54,120 but it can be used as an evil twin 105 105 00:03:54,120 --> 00:03:56,340 and make it look like it's part of your network. 106 106 00:03:56,340 --> 00:03:58,950 So for example, if I set up a rogue access point 107 107 00:03:58,950 --> 00:04:00,270 in the middle of Starbucks 108 108 00:04:00,270 --> 00:04:02,430 and you try to connect to the Starbucks wifi, 109 109 00:04:02,430 --> 00:04:04,320 you may be connecting to the Starbucks wifi 110 110 00:04:04,320 --> 00:04:06,660 or you may be connecting to mine. 111 111 00:04:06,660 --> 00:04:07,950 If you're connecting to mine, 112 112 00:04:07,950 --> 00:04:09,300 I now act as a man in the middle 113 113 00:04:09,300 --> 00:04:11,970 and capture all your traffic and put you at risk. 114 114 00:04:11,970 --> 00:04:13,350 As a cybersecurity analyst, 115 115 00:04:13,350 --> 00:04:15,390 we want to make sure this doesn't happen. 116 116 00:04:15,390 --> 00:04:16,950 And so we're going to scan our airwaves 117 117 00:04:16,950 --> 00:04:19,080 and find out what wireless networks are near us, 118 118 00:04:19,080 --> 00:04:22,260 identify those rogue devices and get them taken down. 119 119 00:04:22,260 --> 00:04:23,647 Now, often students ask me, 120 120 00:04:23,647 --> 00:04:26,370 "How hard is it to create one of these rogue access points?" 121 121 00:04:26,370 --> 00:04:28,830 Well, if you have something like a wifi pineapple shown here 122 122 00:04:28,830 --> 00:04:31,260 you can easily create a rogue access point 123 123 00:04:31,260 --> 00:04:32,790 and then become a man in the middle 124 124 00:04:32,790 --> 00:04:35,190 for all those unsuspecting users. 125 125 00:04:35,190 --> 00:04:36,840 The next type of rogue device we're going to talk 126 126 00:04:36,840 --> 00:04:38,550 about is a server. 127 127 00:04:38,550 --> 00:04:41,670 Now, an adversary may try to set up a server as a honeypot 128 128 00:04:41,670 --> 00:04:44,730 to start harvesting network credentials or other data. 129 129 00:04:44,730 --> 00:04:47,130 By doing this, they can then be another server 130 130 00:04:47,130 --> 00:04:49,260 on your network and try to trick your users 131 131 00:04:49,260 --> 00:04:51,210 into giving them critical information. 132 132 00:04:51,210 --> 00:04:53,280 They could also use things like ARP poisoning 133 133 00:04:53,280 --> 00:04:55,980 or corrupting name resolution to be able to divert traffic 134 134 00:04:55,980 --> 00:04:58,020 into their server instead of yours. 135 135 00:04:58,020 --> 00:04:59,370 So you want to make sure you're identifying 136 136 00:04:59,370 --> 00:05:02,040 these rogue servers and get them off your network. 137 137 00:05:02,040 --> 00:05:04,350 Another type of rogue device you might have is a wired 138 138 00:05:04,350 --> 00:05:06,000 or wireless client. 139 139 00:05:06,000 --> 00:05:09,000 For example, if somebody brings in their personal laptop 140 140 00:05:09,000 --> 00:05:11,370 takes out the connection from their work laptop 141 141 00:05:11,370 --> 00:05:13,350 and plugs it into their personal laptop 142 142 00:05:13,350 --> 00:05:16,170 they have now added a rogue device, their personal laptop, 143 143 00:05:16,170 --> 00:05:18,330 to your organizational network. 144 144 00:05:18,330 --> 00:05:19,590 This can be a big problem 145 145 00:05:19,590 --> 00:05:22,080 because these are devices you don't control. 146 146 00:05:22,080 --> 00:05:24,840 They have webcams on them, which can see inside the room. 147 147 00:05:24,840 --> 00:05:27,390 They have microphones to record conversations. 148 148 00:05:27,390 --> 00:05:29,490 They might bring malware into your network. 149 149 00:05:29,490 --> 00:05:30,900 Lots of different things can happen 150 150 00:05:30,900 --> 00:05:32,730 when you don't control the device. 151 151 00:05:32,730 --> 00:05:34,050 In an organization if you're using 152 152 00:05:34,050 --> 00:05:35,850 a bring your own device policy, 153 153 00:05:35,850 --> 00:05:37,530 this would not be considered a rogue device 154 154 00:05:37,530 --> 00:05:40,230 because you're allowed to bring them in under that policy. 155 155 00:05:40,230 --> 00:05:41,760 But in most organizations, 156 156 00:05:41,760 --> 00:05:43,860 if you don't have a bring your own device policy, 157 157 00:05:43,860 --> 00:05:46,560 bringing your own personal laptop is not going to be authorized 158 158 00:05:46,560 --> 00:05:48,693 and it would be considered a rogue device. 159 159 00:05:49,590 --> 00:05:51,180 Now, another thing to think about when you talk 160 160 00:05:51,180 --> 00:05:52,740 about authorized client devices is 161 161 00:05:52,740 --> 00:05:55,230 that they could be used in an unauthorized way. 162 162 00:05:55,230 --> 00:05:57,990 For example, I have a workstation in my office 163 163 00:05:57,990 --> 00:05:59,310 that the company gives me. 164 164 00:05:59,310 --> 00:06:01,530 I can log in there using my username and password. 165 165 00:06:01,530 --> 00:06:03,000 All of that is authorized. 166 166 00:06:03,000 --> 00:06:06,330 But I don't have permission to try to SSH into a server 167 167 00:06:06,330 --> 00:06:09,630 or perform network scans or tether my smartphone to it. 168 168 00:06:09,630 --> 00:06:11,310 All of these are things that are unauthorized 169 169 00:06:11,310 --> 00:06:12,990 and so if I do those things, 170 170 00:06:12,990 --> 00:06:15,870 I now have turned that authorized client into a rogue device 171 171 00:06:15,870 --> 00:06:18,630 because that's not following the right procedures. 172 172 00:06:18,630 --> 00:06:20,850 The next type of thing we want to talk about is software. 173 173 00:06:20,850 --> 00:06:23,400 And software can actually be rogue as well. 174 174 00:06:23,400 --> 00:06:25,230 If I just go to the internet and download a piece 175 175 00:06:25,230 --> 00:06:27,450 of software on my workstation and install it, 176 176 00:06:27,450 --> 00:06:29,220 that can go against company policy 177 177 00:06:29,220 --> 00:06:31,890 and it would be considered a rogue device at that point. 178 178 00:06:31,890 --> 00:06:33,000 This can actually have things 179 179 00:06:33,000 --> 00:06:35,280 like malicious DHTP or DNS servers, 180 180 00:06:35,280 --> 00:06:38,670 it might be malware, it could be covert spying software. 181 181 00:06:38,670 --> 00:06:40,290 All of these things could be installed 182 182 00:06:40,290 --> 00:06:41,940 as part of this rogue software. 183 183 00:06:41,940 --> 00:06:44,280 So instead, you should always install software 184 184 00:06:44,280 --> 00:06:46,560 using the appropriate change management processes 185 185 00:06:46,560 --> 00:06:48,120 and make sure that software is clean 186 186 00:06:48,120 --> 00:06:50,340 and ready to go on the network. 187 187 00:06:50,340 --> 00:06:53,190 Another type of rogue device is virtual machines. 188 188 00:06:53,190 --> 00:06:56,280 If you're using a very highly virtualized environment, 189 189 00:06:56,280 --> 00:06:58,080 people can start creating virtual machines 190 190 00:06:58,080 --> 00:07:00,090 that could be used to create rogue servers 191 191 00:07:00,090 --> 00:07:03,180 and services inside that virtualized environment. 192 192 00:07:03,180 --> 00:07:04,680 Now, in the old days if somebody wanted 193 193 00:07:04,680 --> 00:07:06,810 to bring a new server into your offices 194 194 00:07:06,810 --> 00:07:09,060 you would probably see them carrying this big computer 195 195 00:07:09,060 --> 00:07:10,410 and hooking it up. 196 196 00:07:10,410 --> 00:07:13,260 But with virtual machines, it's just software code. 197 197 00:07:13,260 --> 00:07:15,060 So if they could spin up a virtual machine 198 198 00:07:15,060 --> 00:07:17,040 and run software to run a server on it, 199 199 00:07:17,040 --> 00:07:19,590 that would be a way to put a rogue server in your network. 200 200 00:07:19,590 --> 00:07:21,540 So keep that in mind as well. 201 201 00:07:21,540 --> 00:07:24,630 The final area we want to talk about is smart appliances. 202 202 00:07:24,630 --> 00:07:27,210 Now these are devices like printers and webcams 203 203 00:07:27,210 --> 00:07:29,700 and VPN sets and VTC systems, 204 204 00:07:29,700 --> 00:07:31,860 and washing machines, and refrigerators, 205 205 00:07:31,860 --> 00:07:34,830 and smart TVs, and all sorts of other things these days. 206 206 00:07:34,830 --> 00:07:37,260 Everything seems to be internet connected. 207 207 00:07:37,260 --> 00:07:38,850 And when they're internet connected, 208 208 00:07:38,850 --> 00:07:40,950 that means there are potential vulnerability 209 209 00:07:40,950 --> 00:07:42,780 that an adversary could exploit. 210 210 00:07:42,780 --> 00:07:43,830 A lot of these devices 211 211 00:07:43,830 --> 00:07:45,810 are running Linux-based operating systems, 212 212 00:07:45,810 --> 00:07:48,030 but they don't receive the patching and updating 213 213 00:07:48,030 --> 00:07:49,560 like your Linux servers would. 214 214 00:07:49,560 --> 00:07:51,840 And so they are something that could bring vulnerabilities 215 215 00:07:51,840 --> 00:07:53,160 into your systems. 216 216 00:07:53,160 --> 00:07:55,350 As we talk about things like ICS and SCADA 217 217 00:07:55,350 --> 00:07:57,780 we'll go back and revisit smart devices as well. 218 218 00:07:57,780 --> 00:07:58,770 But it is something to think about 219 219 00:07:58,770 --> 00:08:00,630 when you start talking about rogue devices. 220 220 00:08:00,630 --> 00:08:02,670 If you install a new TV in the conference room 221 221 00:08:02,670 --> 00:08:05,880 does that TV have wifi and did you plug it into the network? 222 222 00:08:05,880 --> 00:08:08,490 Because if so, that device could be something 223 223 00:08:08,490 --> 00:08:10,830 that could be used by an attacker against you. 224 224 00:08:10,830 --> 00:08:13,050 So now that we've talked about all the different kinds 225 225 00:08:13,050 --> 00:08:16,140 of rogue devices, and I told you all the bad news out there, 226 226 00:08:16,140 --> 00:08:18,510 how can you figure out what rogue devices there are 227 227 00:08:18,510 --> 00:08:20,160 and how do you detect them? 228 228 00:08:20,160 --> 00:08:22,290 Well, we could perform rogue device detection 229 229 00:08:22,290 --> 00:08:24,000 in lots of different ways. 230 230 00:08:24,000 --> 00:08:25,950 One of them is by doing a visual inspection 231 231 00:08:25,950 --> 00:08:27,540 of ports and switches. 232 232 00:08:27,540 --> 00:08:29,880 Especially if you're dealing with wired networks, 233 233 00:08:29,880 --> 00:08:32,700 this is one of the best ways to find rogue devices. 234 234 00:08:32,700 --> 00:08:34,830 Now, when you're conducting your physical inspection 235 235 00:08:34,830 --> 00:08:36,270 you want to make sure that you're careful 236 236 00:08:36,270 --> 00:08:39,090 to ensure the attacker didn't install some additional piece 237 237 00:08:39,090 --> 00:08:42,690 of equipment or counterfeit equipment with fake asset tags. 238 238 00:08:42,690 --> 00:08:45,690 For instance, if you have a rack of a bunch of Cisco gear 239 239 00:08:45,690 --> 00:08:47,160 and somebody brings in another device 240 240 00:08:47,160 --> 00:08:48,600 that looks like a Cisco device 241 241 00:08:48,600 --> 00:08:51,210 and you had five there yesterday and now you have six, 242 242 00:08:51,210 --> 00:08:52,410 will you be aware of that? 243 243 00:08:52,410 --> 00:08:54,517 Will you see it as you walk in on a daily basis? 244 244 00:08:54,517 --> 00:08:56,910 Well, if you had five and six, you might. 245 245 00:08:56,910 --> 00:08:59,880 But if you had 50 and now you have 51, you might not. 246 246 00:08:59,880 --> 00:09:01,140 And so this is something to keep in mind 247 247 00:09:01,140 --> 00:09:02,430 as you're looking at things. 248 248 00:09:02,430 --> 00:09:05,070 As you go through, you should do inventories either monthly 249 249 00:09:05,070 --> 00:09:07,080 or quarterly to see all the devices 250 250 00:09:07,080 --> 00:09:10,830 that you expect are there and no additional devices. 251 251 00:09:10,830 --> 00:09:12,960 Another detection mechanism for rogue devices 252 252 00:09:12,960 --> 00:09:15,930 is to conduct network mapping and host discovery. 253 253 00:09:15,930 --> 00:09:18,930 You can use an enumeration scanner to help identify hosts 254 254 00:09:18,930 --> 00:09:20,940 via banner grabbing and fingerprinting 255 255 00:09:20,940 --> 00:09:23,460 of those devices across your network. 256 256 00:09:23,460 --> 00:09:25,530 As you start running scans across your network 257 257 00:09:25,530 --> 00:09:26,940 and performing this enumeration, 258 258 00:09:26,940 --> 00:09:29,160 you'll start figuring out exactly what's on your network. 259 259 00:09:29,160 --> 00:09:32,070 You've got 10 Linux servers and they're this version. 260 260 00:09:32,070 --> 00:09:34,740 You've got five Windows 2019 servers, 261 261 00:09:34,740 --> 00:09:36,960 you've got three Windows 2016 servers. 262 262 00:09:36,960 --> 00:09:39,390 Whatever those things are, this will help you do that. 263 263 00:09:39,390 --> 00:09:41,040 And if you know what your baseline is 264 264 00:09:41,040 --> 00:09:42,090 and you write another scan 265 265 00:09:42,090 --> 00:09:43,620 and now you have three new servers, 266 266 00:09:43,620 --> 00:09:44,910 you can then figure out why do you have 267 267 00:09:44,910 --> 00:09:45,990 those three new servers? 268 268 00:09:45,990 --> 00:09:46,823 Because if they didn't go through 269 269 00:09:46,823 --> 00:09:48,180 the proper change control process, 270 270 00:09:48,180 --> 00:09:50,070 they would be rogue devices. 271 271 00:09:50,070 --> 00:09:51,810 If you're worried about wireless devices, 272 272 00:09:51,810 --> 00:09:53,880 you can conduct wireless monitoring. 273 273 00:09:53,880 --> 00:09:56,460 This is also known as wireless sniffing and discovery. 274 274 00:09:56,460 --> 00:09:58,020 And this can be used to find unknown 275 275 00:09:58,020 --> 00:10:01,920 or unidentifiable service set indicators, or SSIDs, 276 276 00:10:01,920 --> 00:10:04,110 showing up within the range of your office. 277 277 00:10:04,110 --> 00:10:05,640 So again, if you have an office 278 278 00:10:05,640 --> 00:10:08,610 and the name was Dion Training as your wifi, 279 279 00:10:08,610 --> 00:10:10,110 and right next door is a coffee shop 280 280 00:10:10,110 --> 00:10:11,730 and somebody sits up a rogue access point 281 281 00:10:11,730 --> 00:10:13,710 called Dion Training and you start seeing 282 282 00:10:13,710 --> 00:10:15,420 there is three different signals coming out 283 283 00:10:15,420 --> 00:10:17,820 from Dion Training, but you only have two in your office, 284 284 00:10:17,820 --> 00:10:19,590 well, that would be a rogue device, 285 285 00:10:19,590 --> 00:10:22,230 and wireless monitoring can help you figure that out. 286 286 00:10:22,230 --> 00:10:24,900 Another good detection mechanism is to use packet sniffing 287 287 00:10:24,900 --> 00:10:26,310 and traffic flows. 288 288 00:10:26,310 --> 00:10:28,440 This can be used to identify any unauthorized 289 289 00:10:28,440 --> 00:10:29,720 protocols that are on your network 290 290 00:10:29,720 --> 00:10:32,790 or any unusual peer-to-peer communication flows. 291 291 00:10:32,790 --> 00:10:35,220 For example, if you're not running any web servers 292 292 00:10:35,220 --> 00:10:38,220 on your network, but you start seeing port 80 is running 293 293 00:10:38,220 --> 00:10:40,350 and sending data out often, 294 294 00:10:40,350 --> 00:10:42,210 that could be an indication that somebody set up 295 295 00:10:42,210 --> 00:10:45,537 a malicious or rogue web server inside your network. 296 296 00:10:45,537 --> 00:10:47,760 And so you want to look into that. 297 297 00:10:47,760 --> 00:10:50,970 And finally, we have NAC and intrusion detection. 298 298 00:10:50,970 --> 00:10:52,320 A lot of security suites 299 299 00:10:52,320 --> 00:10:54,870 and appliances can combine automated network scanning 300 300 00:10:54,870 --> 00:10:57,120 with defense and remediation suites 301 301 00:10:57,120 --> 00:11:00,180 to try to prevent rogue devices from accessing the network. 302 302 00:11:00,180 --> 00:11:02,310 If you're using NAC, you might be using something 303 303 00:11:02,310 --> 00:11:04,830 like usernames and passwords to gain access to the network 304 304 00:11:04,830 --> 00:11:07,320 or even better, digital certificates. 305 305 00:11:07,320 --> 00:11:09,030 If somebody doesn't have that digital certificate, 306 306 00:11:09,030 --> 00:11:10,980 that device can't get on the network. 307 307 00:11:10,980 --> 00:11:12,630 If you're dealing with intrusion detection, 308 308 00:11:12,630 --> 00:11:14,137 it can go and scan the network and say, 309 309 00:11:14,137 --> 00:11:15,690 "I found this new thing. 310 310 00:11:15,690 --> 00:11:18,660 I don't know what it is, and therefore I'm going to flag it." 311 311 00:11:18,660 --> 00:11:20,310 And that way an analyst can look into it further 312 312 00:11:20,310 --> 00:11:22,210 and figure out if it's a rogue device.