Securing Network Device

Securing Network Device

1. Securing Device Access

   • Securing the Edge Router
     • Securing the network infrastructure is critical to overall network security. The network infrastructure includes routers, switches, servers, endpoints, and other devices.
     • Edge Router Security Approaches.. The edge router implementation varies depending on the size of the organization and the complexity of the required network design.
     • Router Hardening
       • Eliminate potential abuse of unused ports and services: Secure administrative control.
     • Operating System Security
       • There are a few procedures involved in securing the features and performance of router operating systems: Configure the router with the maximum amount of memory possible.
   • Secure Administrative Access
     • Securing administrative access is an extremely important security task. If an unauthorized person gains administrative access to a router, that person could alter routing parameters, disable routing functions, or discover and gain access to other systems within the network.

2. Monitoring and Managing Devices

   • Securing Cisco IOS Image and Configuration Files
   • Enabling the IOS Image Resilience Feature
   • Configuring Secure Copy
   • Recovering a Router Password
   • The Primary Bootset Image

3. Assingning Administrative Roles

   • Configuring Privilege Levels
     • Large organizations have many varied job functions within an IT department. Not all job functions should have the same level of access to the infrastructure devices
     • To configure a privilege level with specific commands, use the privilege exec level level [command]
     • The use of privilege levels has its limitations:
       • No access control to specific interfaces, ports, logical interfaces, and slots on a router. Commands available at lower privilege levels are always executable at higher levels.
   • Configuring Role-Based CLI
     • ole-based CLI access enhances the security of the device by defining the set of CLI commands accessible by a specific
     • Root View To configure any view for the system, the administrator must be in root view. Root view has the same access privileges as a user who has level 15 privileges.

4. Using Automated Security Features

   • Discovery Protocols CDP and LLDP
     • The Cisco Discovery Protocol (CDP) is an example of a service that is enabled by default on Cisco routers.
   • Settings for Protocols and Services
     • Attackers choose services and protocols that make the network more vulnerable to malicious exploitation.
   • Cisco AutoSecure
     • AutoSecure can lock down the management plane functions and the forwarding plane services and functions of a router
   • Using the Cisco AutoSecure Feature
     • Use the auto secure command to enable the Cisco AutoSecure feature setup. This setup can be interactive or non-interactive

5. Securing the Control Plane

   • Routing Protocol Authentication
     • Routing systems can be attacked by disrupting peer network routers, or by falsifying or spoofing the information carried within the routing protocols.
   • Control Plane Policing
     • While the primary function of routers is to forward user-generated content across the data plane, routers also generate and receive traffic destined for the control and management planes.

6. Summary

   • When securing a network, device hardening should be the first step. This includes securing the network perimeter, securing administrative access to infrastructure devices, enhancing virtual login security, and using secure protocols over a non-secure protocol. For example, using SSH instead of Telnet or HTTPS instead of HTTP.