Hardening networking devices

To minimize the attack surface of a router, use the following checklist:

• Change all default passwords.
• Create strong passwords.
• Disable the HTTP server and its configurations.
• Disable ping response, such as ICMP Echo Replies.
• Apply access control lists (ACLs) for traffic filtering.
• Disable unsecured services, such as Telnet.
• Update the firmware and operating system to the latest stable version.
• Disable unnecessary services.

The following checklist can be used as a foundation for hardening a switch:

• Apply port security.
• Enforce password policies for a strong password and complexity.
• Use SSH rather than Telnet.
• Disable Dynamic Trunking Protocol (DTP). DTP enables links to become trunks automatically.
• Do not use VLAN 1.
• Enable spanning-tree root guard and BPDU guard.
• Enable DHCP snooping.