Management pages for configuring SOHO routers and wireless access points should moved from the default gateway address to a random IP address to better obscure them from adversaries.
Control Type: Technical
Control Function: Preventive
When configuring a SOHO router or access point, the management page is usually accessed at an address such as 192.168.0.1 or 192.168.1.0. The address at which it resides is usually the default gateway address of the router. . Since these addresses are easily identifiable, adversaries know to simply access this common address to uncover the management page. From here they can start trying to brute force the password for the management page to gain access. If a common management page address is combined with the use of default network device credentials, an adversary can gain access to router management settings with little to no effort. To mitigate this risk, administrators should move the management IP address to a random IP that is not easily guessed. For example, it could be moved from the default 192.168.0.1 to 192.168.0.47. Now, adversaries will need to do deeper searching to uncover the management IP, potentially allowing more time for network administrators to uncover the adversary and remove them from the network.