ISR06: Insecure Network Access Management

How ISR06: Insecure Network Access Management works

Insecure network access management is the failure to control which devices can attach to the internal network and where they can reach once attached. It lives in physical things: access switch ports in meeting rooms and reception, the wireless controller and its SSID profiles, the VLAN plan, and the rule base on whatever routes between zones. The estate looks segmented on the network diagram because VLANs exist; the diagram does not show that the inter-VLAN policy is a single permit-any line, or that a port behind a lobby sofa hands out a user-VLAN lease to anything plugged into it.

It survives because nothing breaks when it is wrong. Segmentation and admission control only ever remove reachability, so every incremental change risks an outage for a business unit while producing no visible benefit, and the exception granted for a printer fleet or a merger becomes permanent. After initial access it decides everything: whether a compromised workstation sees one subnet or the whole estate, whether a visitor with a laptop is on the guest network or the server VLAN, and whether the credential recovered from a wireless capture opens the corporate SSID. The three chapters below take one surface each - Flat Networks And Missing Segmentation covers reachability between zones, Missing Network Access Control (802.1X) covers who is allowed to attach at all, and Insecure Wireless Network Access covers the radio edge.

Keywords: network segmentation, flat network, 802.1x nac, mac authentication bypass, wpa2 psk cracking, guest network isolation

Examples/Proof

• Unused port lease test
  • Attach an authorised test laptop to a live but unassigned port in a meeting room. A DHCP lease in the user VLAN with no EAP exchange first proves there is no admission control at the edge.
• User-VLAN reachability sweep
  • From that lease, probe one service port in the server, management, backup and DMZ ranges. Any open port outside the server range is a segmentation finding, not a host finding.
• Inter-zone rule base read
  • Export the policy that routes between VLANs and grep for source any, destination any. A permit-any rule between the user zone and anything else makes the VLAN boundary cosmetic.
• Guest SSID egress test
  • Join the guest SSID with an in-scope test device and traceroute to an internal RFC1918 address. A reply from an internal hop means guest is bridged, not isolated.

Detection and Monitoring

• RADIUS outcome counters
  • Track Access-Reject and MAB-authorised counts per switch on the NPS or ISE log; a port that only ever produces MAB successes has no supplicant and is an open door.
• Inter-zone deny rate
  • Alert on the firewall counter for new source-destination pairs crossing a zone boundary; a zone whose deny counter is permanently zero is not filtering anything.
• Edge attach events
  • Correlate switch port link-up traps with DHCP lease grants; a lease to a MAC absent from the asset inventory on a port that was down for months is the observable. Post-attach movement belongs to the Unlogged Lateral Movement page.

How to fix and prevent ISR06: Insecure Network Access Management

1. Write the access matrix before changing any device
   • List the zones and the flows that must exist between them. Without it, every later rule is a guess and every exception is permanent.
2. Enforce identity at the physical and radio edge
   • 802.1X with certificates on wired ports and corporate wireless. MAC authentication bypass is a partial control only: it authenticates a value the attacker can read off a label.
3. Replace permit-any inter-zone rules with an explicit allow list
   • Move to default-deny one zone pair at a time, running in log-only mode first so the real flow list is measured rather than assumed.
4. Isolate the networks that carry no user traffic
   • Management, backup, OT and out-of-band ranges should not be routable from the user VLAN at all, only from a jump path. Exposed management interfaces themselves belong to the Exposed Management Interfaces page.
5. Re-test the matrix on a schedule and after every change
   • Keep the reachability probes as a regression suite; segmentation decays through merger, project and vendor exceptions rather than through a single bad change.

Prevention Checklist

• A written access matrix exists and names every zone pair and its permitted flows
• No inter-zone policy contains a source-any and destination-any rule
• Every access port is either 802.1X-enforcing, administratively shut, or in a quarantine VLAN
• Guest wireless terminates outside the internal routing domain and cannot reach any RFC1918 internal range

Last updated 2026-08-24