Module 4 Flashcards
are a primary target for attacks because these devices direct traffic into, out of, and between networks.
Routers
The ____ is the last router between the internal network and an untrusted network, such as the internet. All an organization’s internet traffic goes through
_____, which often functions as the first and last line of defense for a network.
edge router
Edge Router Security Approaches
Single Router Approach
Defense-in-Depth Approach
DMZ Approach
A single router connects the
protected network or internal local area network
(LAN), to the internet. All security policies are
configured on this device.
Single Router Approach
This uses multiple layers of
security prior to traffic entering the protected LAN.
There are three primary layers of defense: the
edge router, the firewall, and an internal router that
connects to the protected LAN.
Defense-in-Depth Approach
The ___ can be used for servers that
must be accessible from the internet or another
external network. The ___ can be set up between
two routers, with an internal router connecting to
the protected network and an external router
connecting to the unprotected network.
DMZ Approach
Three Areas of Router Security
- Physical
- Operating System
- Router Hardening
Place the router and physical devices that connect to it in a secure locked room that is accessible only to authorized personnel.
Install an uninterruptible power supply (UPS) or diesel
backup power generator.
Physical
Configure the router with the maximum amount of memory possible. The availability of memory can help mitigate DoS attacks.
Use the latest, stable version of the operating
system that meets the feature specifications of the router or network device.
Keep a secure copy of router operating system images and router configuration files as backups.
Operating System
Ensure that only authorized personnel have access and that their level of access is controlled.
Disable unused ports and interfaces.
Disable unnecessary services. A router
has services that are enabled by default. Some of these services can be used by an attacker to
gather information about the router and the network.
Router Hardening
Secure Administrative Access
- Restrict device accessibility
- Log and account for all access
- Authenticate access
- Authorize actions
- Present legal notification
- Ensure the confidentiality of data
If an unauthorized person gains administrative access to a
router, that person could
alter routing parameters,
disable routing functions, or
discover and gain access to other systems within the network.
A router can be accessed for administrative purposes
locally or remotely:
Although the aux port option is
available, the most common remote access method
involves allowing Telnet, SSH, HTTP, HTTPS, or SNMP
connections to the router from a computer. The computer
can be on the local network or a remote network.
- Remote access
The administrator must have physical
access to the router and use a console cable to connect
to the console port. Local access is typically used for
initial configuration of the device.
- Local access
Strong password
Combines alphanumeric characters, symbols, and includes a space
one method to create a strong password is to use the space bar and create a phrase made of many words. This is called _____ is often easier to remember than a simple password. It is also longer and harder to guess.
a passphrase
Use a ____ to secure passwords for your online internet activity.
password manager
that authentication requires two or more independent means of verification.
multi-factor authentication
To secure privileged EXEC access, use the enable secret password global config command,
Sw-Floor-1# configure terminal
Sw-Floor-1(config)# enable secret class
Sw-Floor-1(config)# exit
Sw-Floor-1#`
To secure user EXEC mode access, enter line console configuration mode using the line console 0 global configuration command, The zero is used to represent the first (and in most cases the only) console interface. Next, specify the user EXEC mode password using the password password command. Finally, enable user EXEC access using the login command.
Sw-Floor-1# configure terminal
Sw-Floor-1(config)# line console 0
Sw-Floor-1(config-line)# password cisco
Sw-Floor-1(config-line)# login
Sw-Floor-1(config-line)# end
Sw-Floor-1#
To secure VTY lines, enter line VTY mode using the line vty 0 15 global config command. Next, specify the VTY password using the password password command. Last, enable VTY access using the login command.
Sw-Floor-1# configure terminal
Sw-Floor-1(config)# line vty 0 15
Sw-Floor-1(config-line)# password cisco
Sw-Floor-1(config-line)# login
Sw-Floor-1(config-line)# end
Sw-Floor-1#
steps that can be taken to help ensure that passwords remain secret on a Cisco router and switch including these:
Encrypting all plaintext passwords
Setting a minimum acceptable password length
Deterring brute-force password guessing attacks
Disabling an inactive privileged EXEC mode access after a specified amount of time.
To encrypt all plaintext passwords, use the service password-encryption global config command
Sw-Floor-1# configure terminal
Sw-Floor-1(config)# service password-encryption
Sw-Floor-1(config)#
The command applies weak encryption to all unencrypted passwords. This encryption applies only to passwords in the configuration file, not to passwords as they are sent over the network. The purpose of this command is to keep unauthorized individuals from viewing passwords in the configuration file.
Use the command to verify that passwords are now encrypted.
show running-config
To ensure that all configured passwords are a
minimum of a specified length, use the security
passwords min-length length command in global
configuration mode.
R1(config)# security passwords min-length 8
Threat actors may use password cracking software
to conduct a brute-force attack on a network device.
This attack continuously attempts to guess the valid
passwords until one works. Use the login block-for
seconds attempts number within seconds global
configuration command to deter this type of attack.
R1(config)# login block-for 120 attempts 3 within 60
By default, Cisco routers will logout an EXEC session after 10 minutes of inactivity. However, you can reduce this setting using the exec-timeout minutes seconds line configuration command. This command can be applied online console, auxiliary, and vty lines.
R1(config)# line vty 0 4
R1(config-line)# password cisco123
R1(config-line)# exec-timeout 5 30
R1(config-line)# transport input ssh
R1(config-line)# end
Additional Password Security
All plaintext passwords are encrypted.
New configured passwords must be eight characters or more.
If there are more than three failed VTY login attempts within 60 seconds, then lockout the VTY lines for 120 seconds.
Set the router to automatically disconnect an inactive user on a VTY line if the line has been idle for 5 minutes and 30 seconds.
