Owasp Infrastructure

title: 'ISR06: Insecure Network Access Management' description: OWASP Infrastructure Top 10 reference for network access management vulnerabilities including flat networks and missing segmentation

06 Insecure Network Access Management

Identifier: ISR06:2024 Category: Network Security

Description

Network Access Management is a fundamental aspect of internal infrastructure architecture and access control regulation. Qualitative Network Access Management prevents a variety of attacks and can reduce the impact of cyberattacks as well as the movement of threat actors inside the internal infrastructure. A critical risk is the lack of network separation, which would restrict access from one part of the infrastructure to another. Organizations often fail to prevent threat actors from accessing the internal network when the attacker gains physical access to a network port or nearby Wi-Fi. Traffic should be supervised and regulated context-based, close to the application layers, for communication paths that must be allowed.

Risk

• Absence of network separation severely increases the risk of cyberattacks spreading through the internal infrastructure and compromising the entire environment from a single compromised component.

• Without Network Access Control (NAC), an attacker who gains physical access to network components, convinces employees to plug in malicious devices, or reaches nearby Wi-Fi can access internal networks.

• Insufficient access regulation at the application layer allows threat actors to abuse commonly allowed communication paths.

Vulnerability checklist

• No network separation exists between distinct infrastructure segments.

• No Network Access Control (NAC) mechanisms (e.g., certificate-based NAC) are implemented.

• Communication paths between network segments are not dynamically regulated at the application layer.

• Remote access is not secured with technologies like VPNs.

• No access matrix exists to plan and enforce network access management.

Prevention controls

1. Implement NAC mechanisms (e.g., certificate-based NAC) to ensure only approved devices can access the company network.

2. Design network separation in the architecture phase; keep network segments as small as possible following the need-to-know principle.

3. Use VLANs to separate the infrastructure.

4. Supervise and regulate communication paths between isolated network segments.

5. Dynamically regulate bridges and network transitions based on application layer context.

6. Secure remote access using VPN technologies.

7. Develop an access matrix to plan the network access management structure.

Example attack scenarios

Scenario A — Insufficient network separation

A company hosts different customer-facing applications accessible online. Multiple database servers hold data for those applications, alongside servers for internal applications and data. A threat actor finds a vulnerability in one publicly accessible application server and gains complete control. Because of absent network separation, the attacker moves laterally and compromises all database servers as well as internal application and data servers from a single entry point. The exfiltrated data is later sold to other cybercriminals.

Scenario B — Missing NAC allowing rogue device

A company uses a common internal infrastructure with application servers and employee file shares. New network printers are ordered to replace old ones. A threat actor injects malicious hardware into a new printer before it arrives at the company. When the printer is connected to the internal network, the embedded small computer also gains network access because no NAC is in place. The malicious hardware connects to a remote host controlled by the threat actor, establishing a pivot point into the internal network for additional attacks.

Detection guidance

• Audit network topology for missing segmentation between operational zones.

• Check for NAC enforcement on all physical and wireless network ports.

• Monitor for unauthorized or unknown devices appearing on the network.

• Review application-layer traffic controls at segment boundaries.

Remediation

• Implement network segmentation with VLANs and firewall rules between operational zones.

• Deploy certificate-based NAC on all network ports and wireless access points.

• Create and enforce an access matrix governing inter-segment communication.

• Implement dynamic application-layer filtering at network boundaries.

• Secure all remote access channels with VPN or equivalent encrypted tunneling.

• Conduct regular network topology reviews and penetration tests.