Hi, I've read the following article and I'm wondering how Clearpass is reacting on this? Can profiling help to prevent this kind of attacks?
Profiling and proper responses can help and will prevent the attack as described. The core of what is exploited here is that on wired 802.1X the authentication is not bound to encryption. MACSec would offer such binding of encryption with authentication, similar to how it works on WLAN which can't be attacked in this way. However, it is hard to build a solution with that as many switches don't have the encryption capacity needed (hardware support) and I'm not aware of a standard client that supports MACSec.
This risk should be evaluated as part of your larger risk assessments, and a possible compensating control can be to limit, monitor and inspect the physical access to your network and devices attached to it.
At Aruba, we believe that the most dynamic customer experiences happen at the Edge. Our mission is to deliver innovative solutions that harness data at the Edge to drive powerful business outcomes.
© Copyright 2021 Hewlett Packard Enterprise Development LPAll Rights Reserved.