views:

248

answers:

7

We're moving to cheap office space that provides a lot of stuff: receptionist, copiers, printers, microwave and internet access - all of it shared with strangers.

What should I ask to find out if the network is safe to use, and if it's not inherently safe, what can I do to make it safe?

+1  A: 

In short: Be just as careful as you would be with any other public/shared internet connection!

Consider hooking up some decent firewall/router in between your own pc's and the building network (just as you would with an internet uplink). This way you can keep control of all traffic between your own machines.

thijs
That's a good idea - but each office will have its own jack. We'd have to get a router for every office, or pick an office for the router and run our own cables to the other offices.
dl__
Maybe you can have your own router hooked up in their patching closet?
thijs
That's a great idea to ask about.
dl__
What if someone else has the key to the closet? They could simply plug one of their office ports into your router (even by accident), putting them inside your network. That's the easiest way to defeat a firewall.
Mnebuerquo
Ohh.. I hit 50 rep now, so I can comment here instead of adding a new answer... ;-) Anyway, if they've got keys to the closet, they'll likely have keys to other offices in the shared space and could just hijack the port there. At some point, you have to trust your landlord somewhere.
BQ
Yes, I don't know if the network equipment is open to all tenants or if there's a dedicated IT guy for the building. Can I detect an unusual or unexpected computer on the network?
dl__
You could install a network monitor on your own segment to detect just that...
thijs
(Search for arpwatch for example)
thijs
You can also set the router to restrict by MAC address. Someone could clone it, but it would stop any accidental access.
BQ
+2  A: 

Consider it a hostile network if you share it with strangers.

You can put your own section of the network behind a firewall, so the rest of the office is outside. You might have to have your own printer for that though.

To set up such a firewall, you would have to only use one of the office network connections, and run your own network connections to your firewall machine. Typically the network ports in the wall run back to a central room where they are patched into a router or something. If you do not trust this network, you can treat it as another part of the "external" network, and run your own internal network in your office.

Be warned though. If someone can physically get into your office, they can gain access to your computer, or use your network cable to connect a laptop and do things you would like to disallow. You might not want to store any information on your office computers, maybe use just a VNC session. Or you could use laptops and not leave them in the office. If you can physically lock your section of the office it would be a good idea.

Never connect to servers through this network unless you are on an encrypted connection. SSH tunnels should be used for anything that isn't normally encrypted.

There are a lot more things you can do to improve your security. Basically considering the network to be hostile, and assuming that someone is always eavesdropping would be the safest attitude.

Mnebuerquo
Is it more dangerous than the typical internet? I've heard that people that use free wifi in hotels and coffee shops can just watch the emails passwords from others in the vicinity. However, I cannot see my neighbors emails from my house. THis office situation is more like the free wifi?
dl__
The free wifi is dangerous. as is wifi in your house. I use my neighbor's wifi by accident whenever my laptop decides that signal is stronger. Even the secured wireless networks are pretty vulnerable. I treat my home network as hostile, just like the starbucks network.
Mnebuerquo
I think the stakes are higher in your case (, you are running a business aren't you?) Besides that, most ISP's have equipment in place to keep you from sniffing your direct neighbors connection (and vice versa), but your office probably has not..
thijs
Yes, this is a business. That's my biggest concern, that another office will be running a network sniffer and will get our passwords for email, ftp, etc. Right now we use some services that don't offer encrypted access. Might be the first thing we need to change.
dl__
You can partition off an internal section as this answer suggests. I wouldn't use FTP to anything outside of your internal partition. ssh tunnels to any servers is probably a good solution, or you could set up a VPN.
Sam Hoice
A: 

A good hardware Firewall would be an excellent investment for the company, but might be a little rich for one person. Comodo firewall can be set to a paranoid level, even locking down the registry, and is free.

Install Wireshark on your computer, it will allow you to watch all of the network traffic on your computer, and on a second note will allow you to see how much chatter goes on and shut down unneeded services.

Shut down all unneeded services, every port that is open is one more place for attackers to slip through.

Use paraphrases with special char instead of passwords. It would even be better to have pass cards or fingerprint readers in addition to the paraphrases, not instead of.

Physically lock up all computer towers, switches, and routers in cabinets if possible.

Check the network and replace any hubs, if found, with switches. Hubs are BAD.

If scanners or copiers are on the network, make sure that they are covered with ACL's in the router. Attackers have been known to access networks via dial in modems on copiers.

Lastly, make sure there are no modems on your network.

WolfmanDragon
+1  A: 

Regarding the OP's comment to thijs's answer (I can't add a comment yet):

Talk to whoever's in charge of your new office space. The existing connections to the offices have to lead back to a patch-panel/router somewhere. You might be able to put your specific offices/equipment onto a separate network through their existing infrastructure.

BQ
Unless you are the only one with keys to access the patch-panel/router closet, it's part of the hostile network. See the comment to the thijs post.
Mnebuerquo
Certainly true, but in a shared office space like this, they won't even be the only ones with keys to their own offices. Whether it's a patch closet or under his own desk, he essentially faces the same issues.
BQ
+2  A: 

Are you going to be assigned static desk/office space? Or is it more of a "hotel" arrangement where it's first come, first served?

If you are able to have a static (and secure) location, just stick your own firewalling router at the port. That will keep most of the problems out.


Edit to add:

I don't know how sophisticated your shared-office provider is, but you might want to ask if they can assign a virtual LAN (VLAN) group for you and your coworkers, and then put that VLAN behind a firewall. That'll be the easiest way to go.

Toybuilder
We will each have our own locking office (though cleaning staff has access). I know there's inherent danger in accessing unencrypted sites over the internet but it's even worse in a public wifi hotspot. Can I make our offices at least as secure as accessing the internet from home?
dl__
VLAN your group together, and then have your VLAN behind a firewall - that should do it. Edited.
Toybuilder
A: 

Check to make sure they do not have any unsecure wireless networks. At my last office/job it wasn't that we shared space but the day that I decided to switch our office over to wireless routers I found that there was already a wireless lan 'open to the world' from the medical health facility right thru the wall in the office next to us. Given all of the HIPPA rules, etc, I promptly told them of THEIR problem. I documented the conversation with their office manager, as well as sending a written document to them which we filed in our records... Not so much because I'm a nice person but because I didn't want them coming back saying that WE had done something on their network. If their system is insecure you need to safeguard yourself against their ability to blame anything on you if something goes bad with them.

SomeMiscGuy
A: 

If you want to be really paranoid, you can install VPN clients on every computer, and have a off-site VPN server at a datacenter... But that eats into your bandwidth, and is probably more complexity than you want to put up with.

Toybuilder