Certopolis

CompTIA Network+ (V9)

Network device hardening checklist for Network+

Hardening means patching and turning off nonessential services so there are fewer ways in. NIST guidance says to run only the services a device needs, change default credentials before first use, and restrict who can use each switch port. On operational technology, test that disabling a service is safe before you do it.

Run only what is needed

NIST defines hardening as a process to eliminate a means of attack by patching vulnerabilities and turning off nonessential services.

NIST SP 800-53 control CM-7, least functionality, says to configure a system to provide only mission-essential capabilities and to prohibit or restrict other functions, ports, protocols and services. Its discussion says organizations consider removing unused software and disabling unused ports and protocols.

NIST SP 800-123 says a server should ideally be a single-purpose host, and to remove services that are not required, disabling any that cannot be removed. Its list of services to remove includes file and printer sharing and remote access programs that do not strongly encrypt their traffic, such as Telnet.

Example: a core switch runs a web management service and a file transfer service that no one uses, alongside SSH. Disabling the two services removes them. An access list in front of them still leaves them running.

Default credentials

SP 800-53 control IA-5 requires changing default authenticators prior to first use.

SP 800-123 notes that default account names and passwords are commonly known to attackers. It says to remove or disable unneeded default accounts, and for accounts that must stay, to change the name where possible and set a password that meets policy.

Port security

Cisco's Catalyst 2960-X guide says port security restricts a port by limiting and identifying the MAC addresses allowed to use it. The default maximum is one secure MAC address per port, and the default violation mode is shutdown, which error-disables the port.

The other modes are protect, which drops unknown sources silently, and restrict, which drops them, increments a counter and logs the violation while the port stays up. Secure addresses can be static, dynamic or sticky; sticky addresses are added to the running configuration.

Example: an IP phone with a PC behind it presents two MAC addresses. With defaults, the second address is a violation and the port shuts down. Raise the maximum to two.

Test first on OT devices

NIST SP 800-82 Rev. 3 lists disabling unused ports and services on OT devices after testing to ensure this will not affect OT operation. On a programmable logic controller, a service that looks idle may still matter, so the test comes first.

Where the exam catches people

  • Believing an ACL in front of an unused service is enough: least functionality means disabling services that are not needed.
  • Believing default passwords can wait until the next audit: IA-5 says change them before first use.
  • Believing port security allows several MAC addresses by default: the default maximum is one, and the default violation mode is shutdown.
  • Believing you should disable unused services on a PLC immediately: NIST SP 800-82 says test the impact first.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. An audit finds a core switch running a web management service and a file transfer service that no administrator uses, alongside SSH. Which of the following actions best reduces the attack surface those services create?

    Right. In the game that’s Renown for your Network Security building.

    Not that one: B is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Its discussion says organizations remove unnecessary software and disable unused ports and protocols, because each extra service is another avenue of attack. A service no administrator uses is not mission-essential, so the control calls for it to be turned off, not merely fenced.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

  2. A technician enables port security with defaults on a port serving an IP phone with a desktop daisy-chained behind it, and the port goes error-disabled. Which of the following settings must change so both devices connect?

    Right. In the game that’s Renown for your Network Security building.

    Not that one: B is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    A phone with a desktop behind it presents two source addresses, so the second one is a violation; with the default violation mode of shutdown the port goes error-disabled. Raising the maximum to two is the change that lets both devices pass.

    Written from www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_010010.html

  3. A technician hardening a programmable logic controller on a factory floor finds several network services it does not appear to use. Which of the following should the technician do first?

    Right. In the game that’s Renown for your Network Security building.

    Not that one: B is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    On a production controller the first step is therefore the test, because a service that looks idle may carry a control or monitoring function whose loss stops the process; only once the test passes are the services disabled and kept disabled.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf