We recently had an IT audit at one of my clients’ locations. One of the issues raised by the auditor was that our DHCP server was a security risk because it would allow anyone to plug in to the LAN, get an IP address, and start browsing or scanning the network for vulnerabilities.?
One alternative would be to maintain our DHCP server, but to have it only support DHCP reservations, and not just give out IPs to anyone who asks for them. (In other words, no leases in the scope without a reservation.) This would keep an unauthorized computer from being able to “just plug in” and go, as it were.?
Another concern would be that a hacker could plug in their own DHCP server, and start giving out leases on the LAN before it was detected, and then set up their own DNS,?routes, etc.
What does it take for this to be considered an “acceptable risk?” Where would you draw the line, in this case? Statics, reservations, or push back and say “we want our open DHCP?”
Please leave your feedback and thoughts on this. If you don’t want to comment on my blog, drop me a note on Twitter or Pownce or Facebook or Jaiku or Plurk or Identica or any number of other social networks I’ve lost track of. I’m “nikolaidis” on all of them, except Facebook, where you’ll have to use the link or track me down the hard way.
The personal blog of Peter Nikolaidis