topic Re: Re-evaluating current structure in General Topics

Re-evaluating current structure

MemphisBrothers — Wed, 06 Mar 2013 03:04:21 GMT

I am currently managing users via AD groups but need a more granular approach. I recently added a BYOD device manager to my network. It divides my 2 main groups using a specific IP range. If I use this method to manage users I will probably have to reset all my policies. My question is should I start by blocking all processes then open just what we need. Which rule should go first?

I have Students and faculy-Staff

Faculty-Staff can have network access, printers etc. social media, streaming media, Netflix etc

Students with Auth machines can have network share access

No Social Media, games, (all the usual blocks) limited (QOS) streaming media, no Netflix, Hulu TV.

What rules should I start with

Re: Re-evaluating current structure

darren_g — Thu, 07 Mar 2013 00:35:36 GMT

Depends on how savage you want to be.

If you want to work up from a "deny everything" scenario, I would start with two rules for each affected zone (facility & students) or IP range.

First rule - allow selected applications. Remember, you need to start with the most OPEN rule first, because rules are processed sequentially, and if you make your first rule "deny everything", then all traffic will hit this rule, match, and nothing else will be processed.

Actually, you can do it with three rules - I'd do something like this

Source: Facility zone/IP range - Allow : required apps

Source : Student zone/IP range - Allow : required apps

Source : Any - Deny : Any

That way, anything which doesn't match the first two rules rull fall through to the "deny" rule and be blocked. The most open rule (the faculty one) should be the first security rule in your list, then the next most restrictive one (the student rule), then the complete deny rule.

If you want to be more open, it's a little more complex.

Re: Re-evaluating current structure

MemphisBrothers — Thu, 07 Mar 2013 15:01:23 GMT

It is a step. We have Spring Break coming up. Perfect time to re design the policies. I'll start with the Scorched earth policy and open from there.

Re: Re-evaluating current structure

darren_g — Thu, 07 Mar 2013 21:44:09 GMT

If that's your policy, then go for it.

I work the other way around - I do three rules, but the final one is an allow any/any - but email me a report about it so I can slowly close loopholes.

I find that leads to less complaints when Fred Nerks favourite, business critical application suddenly stops working. 🙂