Determining Security Controls in a LAN

1. Which of your original hypotheses you feel most confident about and why
This was the first thing of the unit, so guessing that some device was sending out packets
misdirect other devices was kinda spot on to what a rouge DHCP server is 

2. Which scenario was hardest to interpret
the device receiving a gateway that didn't match the router seemed confusing since
the context around it was hard to understand

3. How talking with another pair strengthened or changed your thinking
They helped guide through the ones struggled with

4. Patterns you started to notice across multiple scenarios
A device connects and starts doing some form of evil on the network, and the best way to prevent that is to prevent the device from connecting.

The most threatening attack is probably the Unauthorized Plug-In Device. Especially for being detected, it literally becomes a game of hide and seek with the administrators to detect where its connected, and shut it off/unplug it. looking at the ip neigh command, if the device was configured to act like a standard computer, it would be impossible to tell that it was malicious. It also serves as the base for other attacks, and could be used repeatedly while shut down between strikes to conserve either power or increase concealment. Focusing on normalcy, it could hide both by being a really small device tucked into a really hard to reach corner of a lab, and on the network side pretend to be a device that only turns on for a very short amount of time during an attack, and stays idle awaiting command otherwise.

the ip addr and ip route of VM2, reveals interface and ip of the device

arping and tcpdump side by side, tcpdump on the left showing it is receiving the who-has pings

Some of the physical security vulnerabilities relevant to a pharmaceutical research environment include:
Physical side:

1. Accidents
While rare, geniune attacks on the building could happen. These could be accidental, most common in some form of car/truck accidentally hitting the building. Optimally, a
barrier of some kind would surround the whole facility to prevent anything from getting too close 

2. Unknown Persons
Having unknown people around the building presents a risk that they will try something. This would mostly be outside, but if someone managed to find their way inside (having
the door held for them, etc). then that presents a grave security risk. If they aren't closely monitored, they could possibly make their way into the heart of the facility.

3. Relying on Keycards
Keycards can be stolen or lost. If the door to a really important filing cabinet is secured by a keycard, then anyone with that keycard could get in, including bad actors.  This 
would be a risk for every door secured only by a keycard.

4. Surveillance Blindspots
If cameras have a blindspot, they loose most of their effectiveness. If a threat figured out where those blindspots are and how to abuse them, they are null. By avoiding any
surveillance, attacks could have more time to get deeper into the facility unnoticed.

5. Insiders
If the physical security is tight, the easiest way for an attack to get inside is to be hired to work there. This could affect anywhere in the facility, but its riskier for higher access
positions.

6. Environmental Weaknesses
Not directly a person planning to do something nefarious, but for a company (especially a pharmaceutical), the environment control has to be high tier. Drugs could behave
differently or even spoil, and computers could break if temps are kept too hot.

1. Environmental Controls
   In order to mitigate or prevent the effects of: Fire, Natural Disaster, Power Outage, Acts of God, Heatwaves, ETC, environmental controls must be put in place. At the most basic, these most regulate temperature and humidity, as well as have more extreme controls for extreme cases. If there is a fire, water cannot be used as it risks damaging equipment. Inside, Non flammable gas floods the building while oxygen is removed. This snuffs out the fire, and doesn't damage any equipment. Filters also must be used at any air intakes to prevent small dust particles from gunking up fans, and other equipment.

2. Access Control
   Without clear controls on who can go where,  Risks present themselves. By using biometric identification to pass through different security zones (and within them), these are averted. Keycards should only be used for low security places, as they can be stolen, while anything biometric is 1 of 1 to the specific user. Zones should be set up between different areas (E.G there is no path from the server room to the labs without requiring a I.D. with both server and labs access). Mantraps can also be used to catch bad actors, places where nobody but someone new to the building looking for something they shouldn't be. Google uses eye identification, and fingerprint sensors on locks are becoming common. 

3. Surveillance and Detection
   On top of automatically controlling access to regions, they also need to be monitored to make sure that access controls haven't failed. The easiest way to do this is a robust monitoring system consisting of taking logs whenever someone enters a room, tracking them as they are within it, and then logging their leaving. Combining this with a central security room that closely monitors both everyone on site and the network traffic.

4. Hardware Security
   On top of the manned security measures, automatic measures should also happen. Automatic is being a bit flexible here, as locking the door to cages that actually contain the servers within server rooms is another "automatic" technique. Ontop of multi layered locks, the cabling between servers must also be secure, by routing them in secure channels and not just leaving them lying on the floor. Software should also be configured to dissallow random devices to be connected to open ports.

5. Personnel and Procedures
   for managing personages on the premises, every person requires special privileges. Visitors aren't to be trusted at all until their identity can be verified. For workers, the same should be applied until they prove who they are. Visitors who can be somewhat trusted (E.G. inspectors), should be closely escorted, never being allowed alone with anything sensitive. Employees should also do their best to never be alone, always working in atleast pairs but preferably more. When entering a locked room, each employee must use their own card, even if that means one enters, the door closes and relocks, then the other unlocks and enters. They also must be trained to prevent leaks of information, including anti phishing training.
   
   

Any implementation of these suggestions will take time. Therefore, it is important to explain which ones are most necessary and how those will mitigate the most. The easiest of these is keycards/biometric unlockers to section off the facility. Using a combined keycard/biometric lock, and just replacing the locks on the important doors wouldn't take too long, and using temporary keycards until everyone's in the system wouldn't disrupt. This would heavily mitigate almost every physical attack, as if the attacker isn't there they don't present a risk of damage. This is similar to Network Segmentation on the software side, and would in tandem to make it so that in order to work with official data you have to be physically in the right place connected to the right VLAN. Additionally, aiming for camera coverage of common walkways can help security officers in their early stages figure out what part of the building someone is in, and then adding more over time until the building is fully covered without blindspots. This would allow an attacker to be found before they can attack. Finally, ensuring a proper environmental control system is put in place doesn't disrupt work, but does ensure regulatory compliance, and network/physical safety.

This was the culmination of this unit, a official writeup containing the recommended security protocols for a LAN. It contains actual evidence collected from the school's LAN, and mixes that with technical writing for easy reading and understanding, but high level enough to be exactly understood by IT