Introduction
The basic security measures like implementing firewalls, anti-virus, and wireless encryption are probably second-nature for most IT administrators. Hackers know this and constantly find new methods—or continue old methods we don’t widely protect against—to penetrate our networks.
We already discussed some lesser known security threats specific to Wi-Fi. Now we’ll take a look at some more general network vulnerabilities you might not be aware of and discover how to protect ourselves.
Printer and Copier Hacking
Network-connected multifunction printers and copiers should be treated just like any other network device or computer. When left unsecured, employees and thieves can potentially access saved copies of documents from the hard drive, change settings, and eavesdrop on the network to capture print jobs. And if somehow exposed to the Internet, hackers around the world could potentially find and hack into it.
To secure your printers, start by evaluating their physical location and possibly reposition to provide better physical security. And to prevent accidental or intentional pickup by others, consider a printer that requires individual identification, like a PIN, at the printer before it actually prints.
To help prevent users or hackers from accessing saved documents and changing settings, ensure you set (or change the default) password for admin access on your printers and/or print servers. Also, if your printer or print server uses SNMP to communicate (such as HP’s JetDirect line), try to change the default SNMP community names to something else. And instead of SNMPv1 or SNMPv2, try to use SNMPv3, which adds authentication and encryption.
To prevent network eavesdropping of print jobs, use a printer or print server that encrypts connections to and from the PCs. You may find a proprietary solution or those that support the IEEE Standard 2600 from the Hardcopy Device and System Security Working Group.
Like your computers and other devices, make sure you keep your printers up-to-date with any new firmware and/or driver releases.
Wi-Fi Router Hacking via WPS PINs
If you have any wireless routers and you don’t use Enterprise-level security you should be aware of a vulnerability with the Wi-Fi Protected Setup (WPS) standard that has been built into the majority of wireless routers since 2007. Unlike most other Wi-Fi threats, using a strong encryption passphrase or password won’t protect against this weakness.
For more information about the WPS vulnerability and how to protect your wireless router(s), refer to my previous article: 4 Hidden Wi-Fi Security Threats.
Laptop and External Drive Theft
Many, in IT are aware of the consequences of laptops or external drives becoming lost or stolen and data possibly getting into the wrong hands, but most ignore this vulnerability.
Remember, the data on computers isn’t your only worry; there can also be stored websites and network passwords, browsing history, and other sensitive data in addition to documents. Also Windows and even BIOS passwords can be easily cracked, removed, or bypassed. Encryption is the only method that will keep a computer or hard drive data completely secure.
For computers running the Ultimate or Enterprise edition of Windows Vista or later, you may be able to use Microsoft’s BitLocker feature to encrypt your entire drive. With Windows Vista and 7, you must enable BitLocker after the Windows install, but with Windows 8 and later you’ll be able to activate it prior to the Windows installation as well.
For computers not running the Ultimate or Enterprise editions or those that aren’t compatible with BitLocker, consider using a third-party solution such as the free and open source DiskCryptor.
For external or flash drives, consider using BitLocker To Go for users running the Ultimate or Enterprise edition of Windows 7 or later. However, keep in mind when the drive is plugged into a Windows XP or Vista machine, the user can’t write files to the encrypted drive and only read or copy them.
For users not running the Ultimate or Enterprise edition of Windows 7 or later, consider a third-party solution for encrypting external or flash drives, such as the free and open source FreeOTFE or TrueCrypt.
Also keep in mind you can purchase some flash drives pre-encrypted, though costing more.
To better control and enforce encryption policies of USB storage devices and other removable media, consider a commercial solution such as Lumension Device Control.
I/O Ports and Drives
If you’re really concerned about the security of your data consider locking down the input/output ports and drives, like USB ports, serial and parallel ports, memory card slots, and optical and floppy drives. This can help prevent users or outsiders from maliciously stealing data or to simply prevent users from using external storage due to the data theft issue.
Windows, however, don’t provide any specific features to help control ports and drives. But they are some workarounds you could consider. For instance to block new USB storage devices from installing, deny access of these two files to the desired users or groups by modifying their file permissions: %SystemRoot%\Inf\Usbstor.pnf and %SystemRoot%\Inf\Usbstor.inf. And to block any previously installed USB storage devices you can edit the following registry key and give it a value of “4”: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor.
For better port and drive control, consider a commercial solution. For instance, Lumension Device Control can help control what methods are used for transfers, require encryption on the removable storage, limit data transfer amounts, log all file transfers to removable storage, and protect help against malware.
Smartphone and Tablet Theft
Lost or stolen smartphones and tablets are also a threat to your network security. Though they don’t typically hold as much sensitive data as laptops or external drives, they still could be loaded with your company email, VPN access, and wireless network password. Thus even for employee-owned devices you should consider implementing some security policies.
Most mobile operating systems support Microsoft Exchange syncing with the ability to enforce security functionality, like PIN security on the mobile devices where the user must enter a PIN or password to unlock their device. Some also offer remote locating, locking and wiping features so you or employees can track and secure mobile devices after they become lost or stolen.
For iOS devices, Apple offers the Apple Configurator, iPhone Configuration Utility, and many other enterprise functionality and resources. For BlackBerry devices, RIM offers the BlackBerry Enterprise Server and BlackBerry Enterprise Server Express. Though Microsoft and Google don’t provide many enterprise deployment tools for Windows Phone and Android, both do support at least basic management and policy enforcement via Microsoft Exchange ActiveSync (EAS).
Summary
Remember; don’t just concentrate on the basic security practices. For a truly secure network you need to regularly investigate new or lesser known vulnerabilities and protect against them.
In this article we discovered susceptibilities of network printers, wireless routers, laptops and mobile devices, and removable storage. Remember to password protect your printers, try to use those that support encrypted connections, and keep them updated. If you have any wireless routers, ensure you address the WPS vulnerability. For laptops and removable storage, consider encrypting them to protect your data. And for smartphones and tablets connecting to your email, try to enforce security policies and implement a remote locating, locking, and wiping solution in case devices become lost or stolen.
