Hardening Cisco Routers: Help for Network Administrators

by Thomas Akin

Overview

As a network administrator, auditor or architect, you know the importance of securing your network and finding security solutions you can implement quickly. This succinct book departs from other security literature by focusing exclusively on ways to secure Cisco routers, rather than the entire network. The rational is simple: If the router protecting a network is exposed to hackers, then so is the network behind it. Hardening Cisco Routers is a reference for protecting the protectors. Included are the following topics:

• The importance of router security and where routers fit into an overall security plan
• Different router configurations for various versions of Cisco's IOS
• Standard ways to access a Cisco router and the security implications of each
• Password and privilege levels in Cisco routers
• Authentication, Authorization, and Accounting (AAA) control
• Router warning banner use (as recommended by the FBI)
• Unnecessary protocols and services commonly run on Cisco routers
• SNMP security
• Anti-spoofing
• Protocol security for RIP, OSPF, EIGRP, NTP, and BGP
• Logging violations
• Incident response
• Physical security

Written by Thomas Akin, an experienced Certified Information Systems Security Professional (CISSP) and Certified Cisco Academic Instructor (CCAI), the book is well organized, emphasizing practicality and a hands-on approach. At the end of each chapter, Akin includes a Checklist that summarizes the hardening techniques discussed in the chapter. The Checklists help you double-check the configurations you have been instructed to make, and serve as quick references for future security procedures.Concise and to the point, Hardening Cisco Routers supplies you with all the tools necessary to turn a potential vulnerability into a strength. In an area that is otherwise poorly documented, this is the one book that will help you make your Cisco routers rock solid.

Product Details

ISBN-13:	9780596551902
Publisher:	O'Reilly Media, Incorporated
Publication date:	02/21/2002
Sold by:	Barnes & Noble
Format:	eBook
Pages:	194
File size:	2 MB

About the Author

Thomas Akin is a Certified Information Systems Security Professional (CISSP) with a decade of experience in information security. He is the founding director of the Southeast Cybercrime Institute at Kennesaw State University, where he also serves as chairman of the Institute's Board of Advisors. He is an active member of the Attorney General's Georgia Cybercrime Task Force and heads its education committee. Heavily involved in Atlanta's InfoSec community, Thomas spends much of his time teaching, writing, and trying to keep his security, network, and Unix certifications up to date. Finally, he is the owner of and principal consultant for CrossRealm Consulting. More information about Thomas can be found at http://www.crossrealm.com.

Table of Contents

Preface

1. Router Security
Router Security?
Routers: The Foundation of the Internet
What Can Go Wrong
What Routers Are at Risk?
Moving Forward

2. IOS Version Security
The Need for a Current IOS
Determining the IOS Version
IOS Versions and Vulnerabilities
IOS Security Checklist

3. Basic Access Control
Authentication Versus Authorization
Points of Access
Basic Access Control
Remote Administration
Protection with IPSec
Basic Access Control Security Checklist

4. Passwords and Privilege Levels
Password Encryption
Clear-Text Passwords
service password-encryption
Enable Security
Strong Passwords
Keeping Configuration Files Secure
Privilege Levels
Password Checklist

5. AAA Access Control
Enabling AAA
Local Authentication
TACACS+ Authentication
RADIUS Authentication
Kerberos Authentication
Token-Based Access Control
AAA Security Checklist

6. Warning Banners
Legal Issues
Example Banner
Adding Login Banners
Warning Banner Checklist

7. Unnecessary Protocols and Services
ICMP
Source Routing
Small Services
Finger
HTTP
CDP
Proxy ARP
Miscellaneous
SNMP
Unnecessary Protocols and Services Checklist

8. SNMP Security
SNMP Versions
Securing SNMP v1 and v2c
Securing SNMP v3
SNMP Management Servers
SNMP Security Checklist

9. Secure Routing and Antispoofing
Antispoofing
Routing Protocol Security
Routing Protocol and Antispoofing Checklist

10. NTP
NTP Overview
Configuring NTP
NTP Checklist

11. Logging
Logging in General
Router Logging
ACL Violation Logging
AAA Accounting
Logging Checklist

A. Checklist Quick Reference

B. Physical Security

C. Incident Response

D. Configuration Examples

E. Resources

Index