Securing Network Devices

Securing Network Devices

1. Edge router security

   • Single Router Approach
   • Defense-in-Depth Approach
     • Edge router
     • Firewall
     • Internal router
   • DMZ Approach
   • Three areas
     • Physical Security
     • Operating System Security
     • Router Hardening

2. Administrative Access

   • Security
     • Restrict device accessibility
     • Log and account for all access
     • Authenticate access
     • Authorize actions
     • Present legal notification
     • Ensure the confidentiality of data
   • Access
     • Local
     • Remote
       • SSH
       • HTTP
       • HTTPS
       • Telnet
       • SNMP
         • Manage devices on an IP network
         • Elements to NMS
           • SNMP manager
           • SNMP agents
           • MIB

3. Passwords

   • MD5
   • scrypt
   • sha256
   • Logging Failed Attempts

4. SSH

5. Privilege Level

   • 16
     • (1) User EXEC mode
     • (15) Privileged EXEC mode
   • Role- Based CLI
     • More granular access
       • Security
       • Availability
       • Operational Efficiency
     • Views

6. Secure Management

   • Cisco IOS resilient
     • Faster recovery
   • Secure Copy Protocol
   • Management Access
     • In-band
     • Out-of-band
       • Highest level of security
   • SYSLOG
     • Method of accessing system messages
       • Gather logging information
       • Select the type of logging information
       • Specify the destinations of captured SYSLOG messages
     • Messages Levels
       • 0-4
         • Software or hardware functionality
       • 5-6
         • Notifications and informational
       • 7
         • Output generated by issuing various debug commands

7. Security Features

   • CDP
   • LLDP
   • Services
   • Protocols
   • Cisco AutoSecure

8. Control Plane

   • Policing
     • Data plane packets
     • Control plane packets
     • Management plane packets
     • CoPP Operation
   • Vulnerabilities
     • ACLs

Images and files in the map