Endpoint Security & Access Control
Corporate networks are increasingly targeted deliberately — hacktivism, espionage, revenge from former employees, ... The focus is not on opportunistic attacks on home users, but on targeted actions with potentially major damage. Security is therefore a story that spans every layer and every component, not just one technique or one product.
Types of Attacks
| Attack | Description |
|---|---|
| Eavesdropping | An unauthorized party listens in on traffic (sniffing, snooping) |
| Data Modification | Traffic intercepted and its content altered |
| IP Address Spoofing | Fake IP datagrams to mislead recipients |
| Password-Based Attacks | Taking over an existing account for further attacks |
| Denial of Service | Overloading systems so they stop functioning |
| Man-in-the-Middle | Positioning an intermediary in communication to monitor or modify it |
| Malware | Malicious software as the vehicle for an attack on the system |
Consequences of an Attack
The end result almost always falls into one of these two categories:
- Denial of Service — the business (partially) out of operation
- Data breach / Data loss — information leaked or destroyed
Consequences for an organization: reputational damage, loss of customers, loss of competitive advantage, damage claims, recovery costs, ...
Reconnaissance attacks are not harmless — even though they don't directly cause damage, they're often the precursor to something bigger.
Attack Vectors
How do attackers get in?
| Vector | Risk |
|---|---|
| Malware or social engineering | |
| Unencrypted devices | A stolen laptop with unencrypted data |
| Cloud storage | Incorrect permission settings |
| Removable media | USB sticks as a carrier for malware or data theft |
| Hard copy | Paper documents not destroyed |
| Faulty access controls | Weak passwords, poor ACLs |
| Social engineering | Employees unknowingly giving out info |
BYOD Risk
Personal devices brought into the corporate environment:
- Not managed by the organization
- Security is the owner's responsibility — often leaves something to be desired
- Used for both work and personal life, connected to the corporate network
- 27% get stolen or lost, 30% get used by children
Endpoint Security
Endpoint security = all the measures to protect endpoints on the network against unauthorized access — both from outside and from within the network.
Techniques at the network edge:
| Technique | Description |
|---|---|
| VPN | Secured path for remote access |
| NGFW | Next-generation firewall |
| IPS | Intrusion Prevention System |
| AMP | Advanced Malware Protection at the network edge |
| NAC | Network Access Control — who is allowed onto the network? |
Host-based security (antivirus, host firewall, malware detection) falls outside the scope of Enterprise Networking.
NAC — Network Access Control
NAC consists of three components (AAA):
| Component | Question |
|---|---|
| Authentication | Who is allowed access to the network? |
| Authorization | What are allowed users/devices permitted to do? |
| Accounting | What did they do while they had access? |
Focus within Enterprise Networking: NAC on routers and switches.
802.1X — Port-Based Access Control
The problem: anyone who finds a free network jack in a building can plug in a device and immediately get LAN access.
802.1X solves this through port-based authentication — a device must authenticate first before it gets full access to the network. Supported by switches and access points.
3 Parties
| Role | Description |
|---|---|
| Supplicant | The endpoint — has 802.1X-compatible client software |
| Authenticator | The switch or access point — controls the port and grants or denies access based on the authentication server's verdict |
| Authentication Server | Verifies the supplicant's identity (typically a RADIUS server or Network Policy Server) |
Operation
- Device connects to the network → only EAPoL (EAP over LAN) traffic is allowed through
- The switch forwards EAP messages to the authentication server via RADIUS/Diameter
- The authentication server verifies the identity
- Based on the verdict: allow the port, block it, or place the device in a specific VLAN
EAP versions
- EAP-TLS — mutual certificates (client + server), TLS-encrypted, strongest option
- PEAP-MSCHAPv2 — TLS tunnel + password via challenge-handshake, no client certificate needed
- Others: EAP-TTLS, EAP-IKEv2, EAP-SIM, EAP-PSK, ...
When 802.1X Isn't Supported
Not all devices support 802.1X — think printers, IP cameras, IoT sensors.
MAB (MAC Authentication Bypass) — uses the device's MAC address as the authentication method. Less secure (MAC addresses can be spoofed) but usable as a fallback for legacy devices.
Alternative: Switchport Security
If 802.1X isn't available on the switching infrastructure, port security can offer an alternative:
- Network access limited to specifically configured MAC addresses
- On a violation → the port goes into an error state
3 violation modes:
| Mode | Behavior |
|---|---|
| Shutdown | Port goes into err-disabled — manual re-activation needed |
| Protect | Frames dropped, no notification |
| Restrict | Frames dropped + notification via SNMP/syslog |