Hardening Cisco Routers

by Akin, Thomas

• ISBN13: 9780596001667
• ISBN10: 0596001665
• Format: Paperback
• Copyright: 2002-03-01
• Publisher: Oreilly & Associates Inc

Summary

This small, handy reference helps system and network administrators make sure their Cisco routers are secure. Because it's about securing the routers themselves, and not the entire network, it's highly practical. The book includes Cisco Router Security Checklists for quick reference, not to mention value-added topics that incorporate the most current thinking about security: DoS attack mitigation, router auditing, and FBI recommendations on incident response. Hardening Cisco Routers covers a topic that is currently poorly documented but of vital interest to any administrator whose network uses Cisco routers.

Author Biography

Thomas Akin is a Certified Information Systems Security Professional (CISSP) with a decade of experience in information security. He is the founding director of the Southeast Cybercrime Institute at Kennesaw State University, where he also serves as chairman of the Institute's Board of Advisors. He is an active member of the Attorney General's Georgia Cybercrime Task Force and heads its education committee. Heavily involved in Atlanta's InfoSec community, Thomas spends much of his time teaching, writing, and trying to keep his security, network, and Unix certifications up to date. Finally, he is the owner of and principal consultant for CrossRealm Consulting. More information about Thomas can be found at http://www.crossrealm.com.

Table of Contents

Preface	ix
Router Security	1	(5)
Router Security?	1	(1)
Routers: The Foundation of the Internet	2	(1)
What Can Go Wrong	2	(2)
What Routers Are at Risk?	4	(1)
Moving Forward	5	(1)
IOS Version Security	6	(5)
The Need for a Current IOS	6	(1)
Determining the IOS Version	6	(1)
IOS Versions and Vulnerabilities	7	(3)
IOS Security Checklist	10	(1)
Basic Access Control	11	(21)
Authentication Versus Authorization	11	(1)
Points of Access	11	(2)
Basic Access Control	13	(6)
Remote Administration	19	(9)
Protection with IPSec	28	(2)
Basic Access Control Security Checklist	30	(2)
Passwords and Privilege Levels	32	(11)
Password Encryption	32	(1)
Clear-Text Passwords	33	(1)
Service password-encryption	33	(1)
Enable Security	34	(1)
Strong Passwords	35	(1)
Keeping Configuration Files Secure	36	(2)
Privilege Levels	38	(3)
Password Checklist	41	(2)
AAA Access Control	43	(9)
Enabling AAA	43	(1)
Local Authentication	44	(1)
TACACS+ Authentication	44	(3)
RADIUS Authentication	47	(3)
Kerberos Authentication	50	(1)
Token-Based Access Control	51	(1)
AAA Security Checklist	51	(1)
Warning Banners	52	(6)
Legal Issues	52	(2)
Example Banner	54	(1)
Adding Login Banners	54	(3)
Warning Banner Checklist	57	(1)
Unnecessary Protocols and Services	58	(10)
ICMP	58	(5)
Source Routing	63	(1)
Small Services	64	(1)
Finger	64	(1)
HTTP	65	(1)
CDP	65	(1)
Proxy ARP	65	(1)
Miscellaneous	66	(1)
SNMP	67	(1)
Unnecessary Protocols and Services Checklist	67	(1)
SNMP Security	68	(15)
SNMP Versions	69	(1)
Securing SNMP v1 and v2c	70	(6)
Securing SNMP v3	76	(5)
SNMP Management Servers	81	(1)
SNMP Security Checklist	81	(2)
Secure Routing and Antispoofing	83	(13)
Antispoofing	83	(5)
Routing Protocol Security	88	(6)
Routing Protocol and Antispoofing Checklist	94	(2)
NTP	96	(12)
NTP Overview	96	(1)
Configuring NTP	97	(9)
NTP Checklist	106	(2)
Logging	108	(15)
Logging in General	108	(1)
Router Logging	109	(7)
ACL Violation Logging	116	(2)
AAA Accounting	118	(3)
Logging Checklist	121	(2)
Checklist Quick, Reference	123	(10)
Physical Security	133	(10)
Incident Response	143	(6)
Configuration Examples	149	(12)
Resources	161	(4)
Index	165