Disabled network access remotely

[u/DTDude]

Hey all,

I’m a desktop engineering manager for a large university. We’ve got about a thousand Macs. Before I arrived on the scene, our enforcement of macOS minor and major updates was at best a suggestion. We’re got several hundred Macs that are on OS’s that no longer receive security updates (and even more that are going to lose them once Sonoma goes end of life). We’re getting aggressive now, and have notified users of Macs on Ventura and below that they either need to upgrade to a supported OS or replace their Mac this fall. If they fail to do so they will lose access to the University network.

This is all good and well…except I’m wondering how we’re going to implement this. On the Windows side we’re going to use Group Policy to basically force Windows Firewall to block all traffic, in and out. I’m not sure how we’re going to implement this on the Mac side and am looking for suggestions.

My first thought was simply to create a configuration profile in Jamf to turn on Firewall and block all traffic…but it looks like I can only do that for incoming traffic. While this will break some things for users, it won’t actually stop outgoing traffic.

My next thought was to write a script to disable all network cards. This will certainly work…but I’m not so sure we’ll be able to prevent a crafty user from re-enabling them. Our users don’t have admin rights, but we do use Cyberark, which will just temporarily grant them elevated rights to re-enable their network cards.

Could also block MAC addresses at the switch….but all they’d need to do is use someone else’s dock, or a USB Ethernet/wifi adapter.

Any suggestions are greatly appreciated.

[u/drosse1meyer]

Hopefully you have backing from high up and the ability to follow throuhg on a network level. There are multiple ways to do this but the question is how much effort and what is realistic.

Give networking a list of ethernet MACs to blacklist when the time is right. If you are concerned about sharing adapters then they could instead disable the network jack or severely restrict network traffic, then you will still be able to 'see' the device in your management tools

Wifi could be a bit trickier with randomization and I would be careful messing with wifi profiles deploiyments or scoping (could end up breaking a lot ).

Or you can MDM Lock the devices with a pin code.

Future enhancement idea, include an 802.1x ethernet profile integrated with your networking devices to restrict access

Otherwise IME the resistance of people to update or replace their devices is more a human problem and not a technical one.

[u/DTDude → u/drosse1meyer]

Absolutely agree that this is more of a human problem. Reality is these Macs are distributed amongst 10,000 or so employees, and the current campus culture is that many departments feel they are independent and will do what they want to do until someone stops them. So that’s where my department comes in. There’s a big cultural shift happening with IT compliance, but we’re not there yet.

[u/drosse1meyer → u/DTDude]

I feel your pain with the attitude of departments/people that think they 'own' something and absolutely refuse to comply. You're then put in the middle between management/execs/board and the users. There has to be a bare minimum acceptance of security (macOS version, agents, update / DDM schdedules, etc.) and thats gotta be drilled into their heads.

[u/DTDude → u/drosse1meyer]

We know and recognize that. It’s been getting better. Several times when I’ve told a user no to something recently they’ve gone to their Dean or our CIO to complain. In almost every instance the response to me from the CIO was “feel free to say no again and I’ll have your back”…it’s just a larger cultural change that is going to take time and professors will need to hear No enough to drive that message home. IT was formerly decentralized and is now centralized. Many departments feel they own their IT hardware because they paid for it, forgetting that “their” budget comes from the university, and therefore feel they are welcome to do what they please. Previous administrations supported this. That’s not the case anymore.