Best practices in logging the station that did something

Question

I've seen too many incidents of someone having a password they shouldn't have. Thus I want to log the station from where the command came as well as who was logged in at the time. What is the best way to log the machine identity? I was thinking the MAC address except there can be multiple such addresses on a machine. IP won't work because of DHCP.

What's should I be recording to ensure the machine can be identified in the future?

Answer 1

Your problem is that MAC addresses can be spoofed.

If you use 802.1X authentication, this is no longer a problem. Provided that either you are using dot-1X or you don't care about MAC spoofing, then you need to record four things:

• The IP address of the access
• The time of the access
• Your DHCP logs listing which IP address was assigned to which MAC address when
• Who was logged in to which computer when

With these four pieces of information, and a list mapping MACs to computers, you can figure out which user was logged in to the perpetrating machine.

Note: to avoid IP spoofing, you must also use DHCP snooping and IP Source Guard to prevent users from giving themselves static IP addresses.

Second NB: this is operating under the assumption that all equipment connected to the network is company equipment. If this is not true, I suggest reading and logging the IP-to-port mappings from your switches, and recording them. That way you can tell where a computer was physically located.