Basic Device Security

Device Access

There are some basic steps that you can take that are good practices when it comes to your devices.

We need to worry both about internal threats and external threats. External threats are those threats outside of the organization, where they're trying to hack your network from the outside, and we put up things like firewalls to protect your network from those external threats. But there are internal threats as well: people on your network that either want to do some sort of harm, or accidentally cause harm to your network.

When it comes to internal threats, we really have to think about some security measures that we can put into place to protect from those internal threats. One of them is just the simple step of securing your network rooms. You have all this hardware that is sitting inside network closets and server rooms, and if certain people have access to those devices they can get on there and do certain things that they couldn't do if you physically locked this up, so make sure that physical access to these devices is secure.

Another thing that we need to think about is using good password protection on here. If you have really simple passwords that people can hack, then they can get onto your network equipment and start leveraging it. We've talked about several different things in the past about what makes a good password, how to use password strengths, and how to encrypt a password — make sure you're implementing those on your network.

Another thing to think about is to shut down ports that aren't being used. A lot of times what you have is a lot of different ports throughout your whole building, and if you turned all of those ports live it does two things. Number one, it could be really costly, because you have to have switch ports for all of those different ports on your network. The second thing is that those are attack vectors: somebody could come onto your network, plug into those ports, and then be able to have access to your network, and we want to avoid that. So one way to avoid that is shut down used ports — that way, when these ports are not being used you'll turn them off, and then you have to go in there and turn them on.

Of course, there is a balance with this. Sometimes you just want better access, easier access, for your people, for your users; other times you just want more security. So you're going to have to base it on the environment, what type of information you're dealing with, and which networks they are — whether you want to shut down all your ports, or you want to leave some of those jacks live so people can plug into those ports.

Management Traffic

Stopping physical access to our devices is going to be really important. There are some internal threats that, if they have physical access to the equipment, they can leverage that and do things on that device that they couldn't do if they just had remote access. But there are still some things that they can do if they have remote access to the equipment, so we have to start thinking about how we're going to secure our management traffic.

One way that we can do that is we can set up a separate VLAN, a management VLAN, which we've done on our network — one that just has management traffic on it. But that's not enough, because these different VLANs still have access to that with what we've done so far on that management VLAN. What I mean by that is, we've set this up for VLANs and we've also set up VLAN routing, so now even if you're on VLAN 30 you still have access to all of these other VLANs, all of these other devices. So what we need to do is set up some sort of access control list to stop certain access between these VLANs. Access control lists are part of another module of mine that we'll be approaching in the future, but just know that we will want to implement some of that to secure our network.

Another thing you can consider is out-of-band management. What out-of-band management is, is to have a whole separate network with physical equipment that manages these different devices, so then you don't need to worry as much about that remote access to these devices. What this does is it takes it off of a VLAN and puts it onto maybe another switch, or maybe you're setting it up to connect with pieces of hardware that connect into the console cable. There are some different ways to implement this, but essentially it's using a different set of hardware to manage these devices. This has another added advantage: you can have some sort of access that connects differently to these devices — of course, you need to make sure that is secure as well — so that way, if your network goes down and your internet goes offline, you still have access into your network to do some troubleshooting.

Another thing we need to think about is the protocols that we're using to connect to these devices. If I'm on my demo laptop and I'm using Telnet to connect and manage these different devices, the problem is that with Telnet, if anybody is in between — if there's some sort of man-in-the-middle attack and they're seeing the packets go back and forth, or maybe they've turned these switches into hubs — they can see the traffic going back and forth, and then they can read those passwords, because in Telnet the user credentials are not encrypted.

So instead of using something like Telnet, we use something like SSH. That way we can get into this equipment with a secure connection, and those passwords and authentication methods are then secure through SSH, so an attacker won't leverage that. There are other protocols once again, like FTP, where you can use SFTP or FTPS. SFTP and FTPS are actually two different protocols, but whatever the case may be, make sure that they're secure protocols that you're using for that management traffic.

Device Hardening

As we roll out new equipment, we'll also want to make sure that equipment is hardened for the network. Whenever you roll out a new piece of equipment, think about device hardening of that piece of equipment. It's going to vary depending on what that equipment is, but essentially you want to make sure that the firmware is up to date and all the patching is done on there, so that any security vulnerabilities are patched and managed correctly. You're going to want to do that on an ongoing basis, but it's especially important when you're rolling out new hardware, because a lot of times this hardware comes with a much older version that you're going to have to update and patch.

Another thing that you'll need to do is get onto that device and turn off any services that you're not using. The problem is that these devices come fully operational, with a lot of services that you don't need already turned on. The idea behind that is they don't want you to plug in the equipment and struggle with getting it up and running, so it comes with these different services already turned on. You'll need to know what your equipment is and how to turn off those services. So device hardening is going to be dependent on which equipment it is, and you're going to have to look at what the device hardening techniques are for that piece of equipment.

That was a real quick run through of some basic things you need to do on your network to keep it secure: from device access, making sure device access is limited to only those who need access to it, to management traffic, making sure the management traffic is isolated and secure, and then also device hardening, making sure that your patching is up to date and that your devices are hardened to be on your network — to protect against both those internal threats and the external threats.