Network infrastructure must be configured over secure channels, with a preference for physical connections.

Control Type: Technical

Control Function: Preventive

Description: Networking devices have methods for admin-level access and configuration of device settings. These methods vary widely in terms of security. The most secure way to configure networking hardware is through a direct physical connection providing console access. Admins connect an endpoint device to the network device's console port using a rollover cable, which is a serial cable that has pins set on one end, and then reversed on the other end. Since it is a serial cable, admins will need to have a serial to RJ-45 adapter to properly connect to the device using a workstation. However many modern network devices offer USB console ports. Once physically connected, the admin can use their computer to connect to the network device with a terminal emulation program such as PuTTy, which will create a virtual terminal for them. If using a serial cable, the admin needs to configure their serial port to match the device console port's settings. The setting defaults are:

  • Bits per Second = 9600
  • Hardware Flow Control = None
  • Data Bits = 8
  • Parity = None
  • Stop Bits = 1

While a physical connection is recommended for the most secure connection channel, most large networks need a way to remotely configure their network infrastructure. The two most popular options are Telnet and SSH. Telnet is a deprecated protocol using TCP port 23. Telnet should never be used in a modern network, as it sends all data as cleartext, including credentials to the network device configuration. An adversary resident on the local network could easily sniff this traffic and walk away with the credentials. SSH should be used for remote management, as it encrypts all communications with public key cryptography. SSH runs over TCP port 22. If remote management with SSH is used, extra security can be applied by restricting SSH authentication to designated admin IP addresses, so no devices other than admin workstations can connect.