A system and method for securing an Ethernet Connectivity Fault Management (CFM) domain defined on a Virtual Local Area Network (VLAN). In one embodiment, the scheme includes, responsive to registering by an external port with the VLAN, whereby the VLAN is extended to include the external port, monitoring by a boundary Maintenance End Point (MEP) node of the Ethernet CFM domain to determine if bidirectional control frame flow (e.g., Continuity Check (CC) frame flow) is observed thereat; and, responsive to determining by the boundary MEP node that there is no bidirectional control frame flow therethrough, generating an alarm indicative of a potential breach of the Ethernet CFM domain by the external port.