3min chapter

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) cover image

ISC StormCast for Friday, February 16th, 2024

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

CHAPTER

Detecting Rogue Devices in Network Monitoring

This chapter emphasizes the critical role of network monitoring for identifying rogue devices. It examines the use of SNMP for gathering network data, the impact of link status changes, and the challenges posed by network complexity and potential false positives.

00:00
Speaker 2
If it's completely off, you can still tell it's connected. So if your network topology is out of date or someone connected something, they shouldn't, but it's just off when you're scanning, you could still see that at least the device is connected there and then you can go track it down. Yeah,
Speaker 1
so in that case, you would need sort of a periodic scan where you then look for change, basically. Yes. Is this readable with SNMP or something like this remotely where you could easily pull switches?
Speaker 2
Yes. For the Cisco switches, yes, they have an SNMP IMB that stores all the TDR information. So you could have a script that just goes through each port and checks to see if it back connected or not.
Speaker 1
One thing you don't cover in your paper, but earlier, when I went over it again, I thought about this, like when someone connects a remote, a rogue device to a network, they typically need to unblock the network cable and plug into a rogue device. That sort of short time and someone plugs it out, plugs it in. Do you think that's something detectable?
Speaker 2
It is detectable. The question is, do your links go down enough in the network that that's, you know, from normal operations of rebooting people, moving machines. Maybe this is a rogue device that's between your switch in a conference room where people are going to be plugging their laptops all the time. So you would expect that to go up and down anyway. Or if you just have bad connections where your network goes up and down, it wouldn't be useful to, or it wouldn't give you a lot of information to grab that information. But if it's a pretty steady network, you could use that. But
Speaker 1
in short, if the network is big and complex enough where you need that remote monitoring, it's probably too noisy to just use the downtime. Yes. Yes. Oh, that's really cool. So a link to the paper will be in the show notes. And just bear in your program now almost done or I
Speaker 2
have finished. I'm done.
Speaker 1
Finish your all finished and done. So ready to graduate and probably already got your certificate hanging on the wall there.
Speaker 2
I did. Yeah,
Speaker 1
so thanks a lot for joining me here. And again, the link will be in the show notes, great paper. And none of those things you don't really hear so much about. Definitely worth the read. Thank you. Thank
Speaker 2
you. That's
Speaker 1
it for today. Thanks for listening and talk to you again on Monday. Bye.

Get the Snipd
podcast app

Unlock the knowledge in podcasts with the podcast player of the future.
App store bannerPlay store banner

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode

Save any
moment

Hear something you like? Tap your headphones to save it with AI-generated key takeaways

Save any
moment

Hear something you like? Tap your headphones to save it with AI-generated key takeaways

Share
& Export

Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more

Share
& Export

Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode