ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

Network Access Control (NAC)

Network Access Control (NAC) manages and regulates devices accessing a organization's network(s), including personal devices under a Bring Your Own Device (BYOD) policy. NAC systems ensure that only authorized and compliant devices can connect to the network, reducing security risks.
 

NAC performs the following functions:

  • Device Authentication and Authorization: Checks whether the device meets the organization’s security policies before granting access.
  • Compliance Checks: Verifies that devices have up-to-date security patches and configurations. Non-compliant devices may be denied access or placed in a quarantined network zone.
  • Segmentation and Isolation: Restricts devices' access to sensitive areas, limiting potential impact from compromised devices.
  • Continuous Monitoring: Tracks connected devices for ongoing compliance and can automatically quarantine or disconnect those that fall out of compliance.
  • Policy Enforcement: Applies security policies to ensure devices can only access appropriate resources based on their security status.

 

NAC functionality can be provided by dedicated NAC appliances, next-generation firewalls, unified threat management devices, and some network switches and routers.

Sections

ID Name Description
IF020Unauthorized VPN Client

The subject installs and uses an unapproved VPN client, potentially violating organizational policy. By using a VPN service not controlled by the organization, the subject can bypass security controls, reducing the security team’s visibility into network activity conducted through the unauthorized VPN. This could lead to significant security risks, as monitoring and detection mechanisms are circumvented.

IF019Non-Corporate Device

The subject performs work-related tasks on an unauthorized, non-organization-owned device, likely violating organizational policy. Without the organization’s security controls in place, this device could be used to bypass established safeguards. Moreover, using a personal device increases the risk of sensitive data being retained or exposed, particularly after the subject is offboarded, as the organization has no visibility or control over information stored outside its managed systems.

ME022Bring Your Own Device (BYOD)

An organization has a Bring Your Own Device (BYOD) policy, where a subject is authorized to connect personally owned devices—such as smartphones, tablets, or laptops—to organizational resources. These resources include corporate networks, cloud applications, and on-premises systems that may handle confidential and/or sensitive information.

 

The use of personal devices in a corporate environment introduces several risks, as these devices may lack the same level of security controls and monitoring as organization-owned equipment.

PR026Remote Desktop (RDP) Access on Windows Systems

The subject initiates configuration changes to enable Remote Desktop Protocol (RDP) or Remote Assistance on a Windows system, typically through the System Properties dialog, registry modifications, or local group policy. This behavior may indicate preparatory actions to grant unauthorized remote access to the endpoint, whether to an external actor, co-conspirator, or secondary account.

 

Characteristics

Subject opens the Remote tab within the System Properties dialog (SystemPropertiesRemote.exe) and enables:

  • Remote Assistance
  • Remote Desktop
  •  

May configure additional RDP-related settings such as:

  • Allowing connections from any version of RDP clients (less secure)
  • Adding specific users to the Remote Desktop Users group
  • Modifying Group Policy to allow RDP access
  •  

Often accompanied by:

  • Firewall rule changes to allow inbound RDP (TCP 3389)
  • Creation of local accounts or service accounts with RDP permissions
  • Disabling sleep, lock, or idle timeout settings to keep the system continuously accessible

 

In some cases, used to stage access prior to file exfiltration, remote control handoff, or backdoor persistence.

 

Example Scenario

A subject accesses the Remote tab via SystemPropertiesRemote.exe and enables Remote Desktop, selecting the “Allow connections from computers running any version of Remote Desktop” option. They add a personal email-based Microsoft account to the Remote Desktop Users group. No help desk ticket or change request is submitted. Over the following days, successful RDP logins are observed from an IP address outside of corporate VPN boundaries, correlating with a data transfer spike.

IF002.010Exfiltration via Bring Your Own Device (BYOD)

A subject connects their personal device, under a Bring Your Own Device (BYOD) policy, to organization resources, such as on-premises systems or cloud-based platforms. By leveraging this access, the subject exfiltrates sensitive or confidential data. This unauthorized data transfer can occur through various means, including copying files to the personal device, sending data via email, or using cloud storage services.