A customer of mine has hundreds of sites, thousands of servers and tens of thousands of workstations/ desktops. There are policies and procedures and guidelines that dictate firewall policy to protect the perimeter, what services are or are not allowed, what antivirus software will be used, how often it will be updated and more.
We have a recoccuring problem with rogue systems being plugged into the network. These systems tend to be unpatched and unprotected- no antivirus software and open to well-known vulnerabilities. It usually takes about 5 minutes for one of these machines to get infected with Nimda or CodeRed or something else like that still flooding the Internet with infected traffic.
It tends to pose a minimal, but annoying problem because if our other systems are patched as they should be the threat can't really spread. But, inevitably we find other systems that somehow missed a patch or an update and the threat does spread, albeit slowly.
To prevent this, it occurred to me that *ALL* unused ports on *ALL* switches should be shut down. If we did that, any user who had to add a server or workstation to the network for any purpose would have to go to a network administrator to get the port activated giving us a single point of contact that we could use to screen the systems and ensure they are patched and protected before going on the live network.
Can anyone come up with alternate solutions or tell me why my solution won't work- either technically or logistically? It seems logical, but it seems too easy to be the "right" answer.
