Zero Trust for Third-Party Infra: The Forgotten Devices

Ask most organizations to list their third-party vendors, and they'll quickly name their software providers, outsourced services, and cloud platforms. But ask them to list every third-party device connected to their network, and you'll often get a long silence. Networking equipment, IP phones, security cameras, printers, building controls, HVAC systems : all of these are third-party infrastructure, and all of them are potential entry points.

Start with Discovery: 802.1x and Network Access Controls

You cannot secure what you cannot see. IEEE 802.1x (Network Access Control) provides the mechanism to require authentication before any device, third-party or otherwise, gains network access. When a device attempts to connect, 802.1x checks credentials and/or certificates against a RADIUS server and assigns appropriate network segments (VLANs) based on device type and risk profile.

Note: if using 802.1x, ensure you're implementing EAP-TLS. Common alternatives (PEAP MSCHAPv2, EAP-TTLS/PAP) have known vulnerabilities.

If 802.1x isn't deployed, other discovery mechanisms (SIEM collection, network team scanning, managed service providers) can provide detection capability, but these are reactive rather than preventive.

Minimum Security Standards for Third-Party Devices

Every third-party device connected to your network should meet minimum security requirements:

• Encryption: All data at rest and in transit must be encrypted using industry-standard algorithms. Never accept a vendor's proprietary encryption scheme.

• Automatic Updates: Devices must support automatic, digitally-signed security updates for at least three years post-sale, enabled by default.

• Strong Passwords: Devices must force a password change on first use, with minimum complexity (15+ characters recommended) and 90-day rotation. No hardcoded backdoors.

• Vulnerability Management: Vendors must have a vulnerability disclosure program and respond to reported issues.

• Logging: Devices must support log forwarding to your SIEM (SNMPv3 minimum if SNMP is used).

Least-Privilege Segmentation for Infrastructure

Once third-party devices are identified, segment them by use case:

• Security devices (cameras, door sensors) → dedicated VLAN

• Building controls (HVAC, fire systems) → separate, isolated VLAN

• Network equipment → managed separately by network team

• Collaboration equipment (displays, conferencing) → lower-risk VLAN

For the highest-risk devices, consider a DMZ or network enclave that only allows explicitly approved traffic types on approved ports.

Remote Access to Infrastructure: Out-of-Band Matters

Vendors who remotely manage infrastructure often use out-of-band channels (modems, serial console servers, 5G secondary connections) that can bypass normal security monitoring. Ensure these connections: - Use next-generation firewalls - Require MFA - Are covered by your patch management process - Are documented and reviewed regularly

Key Takeaway: Third-party infrastructure is often the most overlooked element of the vendor attack surface. A Zero Trust approach requires discovering, cataloging, segmenting, and continuously scanning every third-party device, including the ones that have been quietly sitting on your network for years.

Tags: Infrastructure Security | IoT | 802.1x | Network Segmentation | Device Management | Zero Trust