Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any "secure" mechanisms.
Let's say despite having added "physical security" in the form of "conduits" for the cable, what if someone is able to drill or cut their way in an undetected manner and adds a listening device or MIM on it.
If crooks are ingenious enough to create ATM skimming devices that emulate the entire physical/ electronic structure & interface then I am sure someone with enough incentive can find a way to physically tap in.
Now, typically between long distance sites VPN is leveraged. What could one do in such scenarios? Do we leverage VPN for such links or are there other ways / mechanisms in tech/ protocol stack & standards?
Communication on a physical Ethernet link, between 2 devices:
- Typically operates at Layer 2 – Data Link layer
- Medium Access Control (MAC) uses Carrier Sense Multiple Access/ Collision Detect (CSMA/ CD) ; Wireless Networks use CSMA/ CA.
It is possible to do MAC ID spoofing as well as listen to the cross talk on an Ethernet link, so various attacks at that layer are possible as outlined below.
Let's say there is physical exposure (which cannot be physically secured) of Ethernet link passing through a public corridor between 2 offices in a building, what ways can you secure the link?
From experts on SE, What are recommended practices, mechanisms, protocols that can be leveraged/ used to secure communication on physically exposed Ethernet links?
- Mechanisms at Layer 1/2
- Mechanisms at Layer 3
http://www.sanog.org/resources/sanog7/yusuf-L2-attack-mitigation.pdf
http://www.slashroot.in/tcp-layer-2-security-threats-and-attacks
https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf
https://www.cisco.com/web/ME/exposaudi2009/assets/docs/layer2_attacks_and_mitigation_t.pdf
Best Answer
802.1AE is the IEEE MAC Security standard (also known as MACsec) which defines connectionless data confidentiality and integrity for media access independent protocols. It is standardized by the IEEE 802.1 working group.
(...)
The IEEE 802.1AE (MACsec) standard specifies a set of protocols to meet the security requirements for protecting data traversing Ethernet LANs. This norm assures incomplete network operations by identifying unauthorized actions on a LAN and preventing communication from them.
MACsec allows unauthorised LAN connections to be identified and excluded from communication within the network. In common with IPsec and SSL, MACsec defines a security infrastructure to provide data confidentiality, data integrity and data origin authentication.
By assuring that a frame comes from the station that claimed to send it, MACSec can mitigate attacks on Layer 2 protocols.