Control 4 – Secure Configurations of Network Devices Such as Firewalls, Routers, and Switches

Control 4 is similar to Control 3 in that it is concerned with maintaining a secure configuration. This time the focus is on network devices.

What is the last thing you did on your network devices? Likely it was add a rule to permit a new traffic flow. When was the last time you made sure the configuration is exactly what you expected?

Where to start?
Several authoritative hardening guides exist and are freely available. Choose one of the below and plan to spend a few hours making sure your network device configurations are secure.

• National Security Agency (NSA) Security Guides for Cisco Routers and Switches.

• Center for Internet Security (CIS) Security Benchmarks exist for most network devices including:

             CheckPoint Firewall Benchmarks
             Cisco Device Benchmarks
             Juniper Device Benchmarks
             Network Device Benchmarks
             Novell Netware Benchmarks
             Wireless Network Devices Benchmarks

• Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIG) are available for network devices.

What else?

Always maintain an updated network diagram. I know. You still should.

Change control forms should be completed (with appropriate approvals) before logging in to the device.

Speaking of logging in, require two factor authentication for every device login.

Alert all administrators of all attempted logins and rule changes.

Compare the current configuration of your network devices to a known good configuration.