Simple explanation
The practical, hands-on steps for locking down network devices and traffic beyond their default, out-of-the-box configuration.
Technical explanation
- Disable unused ports/services — every open port or running service not actually needed is unnecessary attack surface.
- Change default credentials — one of the single highest-impact hardening steps, since default credentials are publicly documented for virtually every device.
- Disable unnecessary protocols — Telnet (unencrypted) in favor of SSH (encrypted), HTTP management in favor of HTTPS.
- Implement access control lists (ACLs) — explicitly defining allowed/denied traffic at routers and firewalls, following least privilege.
- Secure SNMP — using SNMPv3 (which supports authentication and encryption) instead of older versions that send community strings in plaintext.
- Firmware/patch management — keeping devices current against known vulnerabilities.
- Enable logging — ensuring hardened devices are also generating the audit trail needed to detect and investigate issues.
- Use secure protocols for management — SSH instead of Telnet, HTTPS instead of HTTP, SNMPv3 instead of SNMPv1/v2c.
- Physical port security — combined with the logical hardening above, unused physical switch ports should be disabled or placed in an unused/quarantine VLAN.
Synonyms / related terms
| Term | Means | |---|---| | ACL | Access Control List | | SNMPv3 | The current, secure version of SNMP | | Hardening | The general practice of reducing a device's attack surface |
Concept Check
"A network still uses SNMPv1 with the default community string 'public' for monitoring." This is a serious, common real-world hardening gap — SNMPv1 sends its community string (functioning like a password) in plaintext, and "public" is one of the most universally known default values, making this equivalent to having no authentication at all for that management interface. SNMPv3 is the fix, not simply changing the community string within v1/v2c, since the plaintext transmission itself is the deeper problem.
Interview-style Q&A
Q: Why disable unused switch ports rather than just leaving them unconfigured? A: "An unconfigured but enabled port is still a live entry point — anyone with physical access to an empty office or unused conference room jack could plug in and potentially reach the network. Disabling unused ports (or placing them in a dead-end quarantine VLAN) closes that physical attack surface without requiring anyone to remember it's a risk later."
Memory trick
"Default nothing, Encrypt everything, Disable what's unused" — three hardening principles covering credentials, protocols, and unnecessary attack surface respectively.