Disabling Unused Cisco Router Network Services and Interfaces参考.ppt

Cisco Device Hardening Disabling Unused Cisco Router Network Services and Interfaces Vulnerable Router Services and Interfaces Cisco IOS routers can be used as: Edge devices Firewalls Internal routers Default services that create potential vulnerabilities (e.g., BOOTP, CDP, FTP, TFTP, NTP, Finger, SNMP, TCP/UDP minor services, IP source routing, and proxy ARP). Vulnerabilities can be exploited independently of the router placement. Vulnerable Router Services Disable unnecessary services and interfaces (BOOTP, CDP, FTP, TFTP, NTP, PAD, and TCP/UDP minor services) Disable commonly configured management services (SNMP, HTTP, and DNS) Ensure path integrity (ICMP redirects and IP source routing) Disable probes and scans (finger, ICMP unreachables, and ICMP mask replies) Ensure terminal access security (ident and TCP keepalives) Disable gratuitous and proxy ARP Disable IP directed broadcast Router Hardening Considerations Attackers can exploit unused router services and interfaces. Administrators do not need to know how to exploit the services, but they should know how to disable them. It is tedious to disable the services individually. An automated method is needed to speed up the hardening process. What is AutoSecure? AutoSecure helps secure Cisco IOS networks by performing these router functions: Disables insecure global services Enables security-based global services Disables insecure interface services Enables appropriate security logging Secures router administrative access Secures the router management plane Secures the router forwarding plane AutoSecure Operation Modes AutoSecure can be deployed using one of the following two modes of operation: Interactive mode: Prompts the user with options to enable and disable services and other security-related features Noninteractive mode: Automatically executes the auto secure command using recommended default settings AutoSecure Functions AutoSecure can selectively lock down: Management plane services and functions: Finger