“Keep the malware, ya filthy animal” is NOT a line uttered in the 1990 Christmas Classic, Home Alone….but it should be! Well…not really. The internet was still in its infancy in 1990 and infection of computers and networks by malicious software was still a relatively new concept (the term “malware” was first coined only months before Home Alone’s theatrical release). The line would DEFINITELY apply today, however. As nearly everything is operated online, to some extent, and network security is becoming more important than ever! Thankfully, there are high-end tools we use today to ensure that we can control and monitor what devices are accessing our networks. Review how these devices are behaving while on the network. Give the ability to remove said devices if malicious activity is detected. Little Human ClearPass There are numerous blogs and articles that explain how the entire plot of Home Alone would not have occurred had the technology that we use today been available. I’m not going to go down that rabbit hole here. Instead I am going to use the film as an analogy for technology itself…namely HPE Aruba Networking’s security platform “ClearPass”. I’m doing this because I think it makes some of the nuances of the technology easier to understand and because I just feel like it, ok? So, sit back, grab a cheese pizza, and put on some after-shave…I’m about to tell you all about the story of Kevin McCallister, “The Little Human ClearPass”. For those of you that don’t know, HPE Aruba Networking ClearPass is a policy management platform that allows network admins to onboard new devices, grant varying access levels, and help keep their networks secure. It can be dissected into three primary security functions: Identify, Enforce and Protect. And I will use Kevin McCallister to demonstrate each process. Identify Much of Kevin’s success in thwarting full-grown men who are attempting to rob his parent’s house, stems from the fact that he is a very observant little fella. He notices the highly suspicious “Wet Bandits” following him. Kevin monitors their behavior and overhears their conversations. Preemptively, he defends his family home based on his findings. His observations operate in much the same way as ClearPass. ClearPass helps identify what devices are trying to access the network. These findings include where the devices are connecting from and device-specific information such as IP address, OS, type and model name etc. Enforce The key for the “Wet Bandits” to successfully loot all of the luxurious homes in Kevin’s neighborhood while they are all vacant for the holidays. If you’re a burglar…you’re not going to attempt to waltz into a house full of people and hope you go unnoticed, are you? Remember when Kevin turns on every single light in his house and makes it look like there’s an epic party occurring there? Bingo. The burglar policy seems to be: “if the place is occupied, don’t risk it.” Networks have policies too. Ones that can similarly prevent unwanted visitors. ClearPass allows you to enforce these network policies during the onboarding of new devices. Rules can be put into place that define what type of devices users can onboard, how many, and who may onboard a device. After this, access can be enforced in a number of ways. A simple portal can be used or the more secure method of using encryption in the authentication process. Protect The final area of focus in ClearPass security is “Protect”. With ClearPass OnGuard, one can define the “health level” a device must have in order to gain access to the network. The health of individual devices that are connected to the network is crucial to network security. If a device that is attempting to connect does not meet these requirements, it is not allowed on the network. Moreover, policy controls and threat remediation give real-time insight into the activity on the network, allowing threats to be quickly identified. This allows the IT staff to quickly block traffic or disconnect devices if unusual network behavior is detected. What does all that mean in layman’s terms and can I use a metaphor? Sure thing! If you see suspicious folks skulking around your residence, you better ice down your steps, heat your doorknobs and place Christmas ornaments by the windows to discourage unwanted entry. If those crafty villains still a manage to gain entry, you better have some Micro Machines strewn across the floor and have a tarantula handy. It worked for Kevin McCallister and it can work for you and your network! HPE Aruba Networking is just one of the many great vendors that ProCern works with daily. Contact us today for all of your IT needs. Including, but not limited to, cyber security. If you find yourself “home alone” just think, “what would Kevin do?”.
HPE Aruba Networking UXI Sensor In early 2018, HPE Aruba Networking announced they were buying Cape networks, the developers of the Cape sensor. Rebranded as the HPE Aruba Networking User Experience Insight (UXI), the sensor sits on your network. It alerts you whenever your network is having problems. It may not seem like much, but it is an amazing little device that could help IT departments everywhere. When deployed, the HPE Aruba Networking UXI sensor acts like a user on your network, except much smarter. No more complaints about “the internet isn’t working”. Instead, you get personalized alerts telling you exactly what is going wrong. Whether that means DNS is unresponsive, or merely yahoo.com is having an outage. The sensor is designed to work straight out of the box on any network. It just needs to be registered to a dashboard. Then give credentials to the wifi or plug it into the ethernet. It takes so little set up. It can be mailed to a remote site and set up by anyone. All configuration is done in the web portal. All standard tests and alert thresholds come preconfigured. No set up is even needed, though you can definitely still customize it. HPE Aruba Networking Dashboard The dashboard is simple and easy to use. It gives you access to a lot of information about your network. Hover over any piece on the home page to get alert info. Then, click to drill down further and see a trove of other information, such as signal strength, channel, response times for things like dns or dhcp, even websites if you set them up. The sensor can be configured to check both internal and external services. Whether you use internal websites and fileshares, or Google docs and Microsoft OneDrive, you can test them all to be sure they are up and running. If they aren’t, the IT department is the first to know. Proactive Alerts Alerts are sent via email whenever certain customizable thresholds are met. This enables IT departments to know about a problem before a user has a chance to report it. They will also know exactly what went wrong without having to hunt around for the cause of the issue. The alert says which service is down. Quickly letting IT know if the entire internet is down, or if its just the DNS service on a server. Website issues can also be shown through the alerts. Knowing exactly whats wrong, quickly enables the IT department to address the issue faster. This results in less down time and less unhappy users. Cloud Accessibility The dashboard and all data are hosted in the cloud. This allows for you to access it anywhere, at any time. No need to be on site to diagnose an issue. No worries about not being able to see data and alerts while a site is down. Diagnosing issues is half the battle in the helpdesk world. Eliminating this problem, enables the IT department to be far more efficient and timely in resolving those issues. Location, Location, Location Arubas UXI sensor should be placed in a spot where wifi is used most, or problem areas that you would like more information on. It comes with a couple different ways to mount it. It can also be set on a desk or table just as easily. A secure mounting bracket can be deployed in public areas without the fear of it disappearing. All it needs is power either provided by the included power adapter, or by a PoE solution. The sensor also isn’t just limited to wifi. It works over ethernet as well, so you can check all network connections at once. A user experience sensor is a valuable tool for any company, small or large. The key feature is that it enhances the response time of any IT department. Faster response times mean less downtime, which means less time your company is running smoothly. The solution is constantly being updated with more features being added every day to make the jobs of you and your IT department easier. Contact ProCern for more information on this solution or other networking products for your organization.
Using Aruba Dynamic Segmentation will help keep the Boogeyman away One reality terrifying most business owners is the thought of someone compromising their network and their data. Companies spend gratuitous amounts of money and time to protect themselves from cyber threats. They configure edge firewalls and multi-factor authentication mechanisms to protect their most sensitive data in the cloud. The thing that is often left untouched and overlooked are the data ports which are physically accessible to the public. If the business operates in a public or shared office space, the risk of intrusion from an unprotected or unmanaged port is astounding. Aruba Networks have developed a technology that can now extend the same role-based firewall policies that are applied to the enterprise wireless to the wired ports. By enforcing the same role-based policies, administrators can simplify the deployment and management while also staying consistent across the network. Is this a new threat? In truth, the threat has always existed. The difference is that now more than ever, IOT devices require a hard-wired connection to function. This is because many of them do not support the same security and encryption standards we enforce on the wireless network. Some devices simply require the low voltage power supplied from the switch port to function. These devices include security cameras, lighting controllers, intelligent HVAC devices and some printers or scanners. Another common scenario is when there is a need for a wired port for a special event. The port is configured for one purpose but then it is forgotten about. Then, anyone who plugs into that port has whatever access it was originally configured for. The reality is that these devices and circumstances are not going away any time soon. The best way to protect the network and the switch ports is to secure and isolate the clients and the devices from your sensitive networks and services. What have engineers and administrators done about this attack vector? From a management perspective, port security has always been the bane of network engineers and administrators. It has never been very practical or scalable to deploy. One must define clear attributes to distinguish each device from another. Then, you tell the switch port to change the network the device it is connected to or to simply block the port all together. Often the unique attributes used to distinguish these devices are easy to counterfeit. Deploying the configuration on only the public facing ports takes planning and insight. This often falls through the cracks after the initial deployment. Furthermore, the deployment of these settings must be done on each switch in the environment that may be connected to from a public facing port. HPE Aruba Neworking’s Dynamic Segmentation takes a different approach. It unifies policy enforcement and delivers the same seamless experience that people come to expect of wireless connectivity. How does it work? The technology leverages many of the same security and profiling mechanisms that exists in the HPE Aruba Networking wireless world. It applies them to the switch port adding a scalable security solution without the complexities of deploying another costly security product. It works by treating a HPE Aruba Networking network switch like an access point. The switch tunnels the switch port traffic to the Aruba mobility controllers. It profiles the connected devices in the same manner it would a wireless client. If the device passes certain authentication criteria, then it is granted the same access as if it were on the wireless network. If the device has certain attributes but does not pass specific authentication criteria, than it is treated differently. It will be assigned the same role and given the same privileges as it would on the wireless network. In isolating these devices or unknown users, we can better protect the environment at large while not limiting the connectivity some users may need. What else can HPE Aruba Network Dynamic Segmentation do? By tunneling the traffic to the mobility controllers, Dynamic Segmentation provides greater visibility of the traffic from IOT devices and guests users on your network. You can enforce a captive portal with email registration for guest users. This can add some accountability to a visiting contractor or guest speaker. If an employee brings in a consumer device from home and plugs it in, you can distinguish what the device is, where it is plugged in and what it is communicating with. The most valuable use-case for this technology lies in the constant struggle of BYOD and onboarding of employee devices. If an employee chooses to use their own computing device and company policy allows it, you can check the security posture of the device before granting it access to any resources on your network. Ideally those users would have a policy enforced that would allow them to reach only the least sensitive resources and the internet. Why should network/security engineers and administrators be excited about Dynamic Segmentation? Unlike traditional port security which normally rely on 802.1x and radius authentication to authorize access on a single VLAN, Dynamic Segmentation does not require unique network segments to be defined to physically separate users. HPE Aruba Networking uses the term VLAN sprawl to describe the never-ending creation of new VLANs and subnets to create new layer 2 boundaries to physically segment user and device traffic. With this solution, all the unknown devices and users could reside on the same network segment. Because the traffic is tunneled, all the traffic is subject to deep packet inspection, stateful firewall policies, layer 7 application visibility including web content filtering. Most IT professionals usually wouldn’t believe that their wireless controllers are capable firewalls. They would be wrong where Aruba is concerned. Overall, the solution will simplify your efforts at securing the network edge and unifying security into one manageable platform. Why spend time configuring and deploying a solution that you would have to duplicate with the wireless infrastructure? Save yourself from that spooky nightmare. To learn more, contact ProCern.