| V-4582 | High | The network device must require authentication for console access. | Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to... |
| V-5626 | High | The switch must be configured to use 802.1x authentication on host facing access switch ports. | The IEEE 802.1x standard is a client-server based access control and authentication protocol that restricts unauthorized clients from connecting to a local area network through host facing switch... |
| V-3056 | High | Group accounts must not be configured for use on the network device. | Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves... |
| V-15434 | High | The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online. | The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the... |
| V-3012 | High | Network devices must be password protected. | Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user,... |
| V-3143 | High | Network devices must not have any default manufacturer passwords. | Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of... |
| V-3062 | High | The network element must be configured to ensure passwords are not viewable when displaying configuration information. | Many attacks information systems and network elements are launched from within the network. Hence, it is imperative that all passwords are encrypted so they cannot be intercepted by viewing the... |
| V-3210 | High | The network device must not use the default or well-known SNMP community strings public and private. | Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An... |
| V-3175 | High | The network devices must require authentication prior to establishing a management connection for administrative access. | Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling... |
| V-3196 | High | The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device. | SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain... |
| V-3085 | Medium | The network element must have HTTP service for administrative access disabled. | The additional services the router is enabled for increases the risk for an attack since the router will listen for these services. In addition, these services provide an unsecured method for an... |
| V-3069 | Medium | Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules. | Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network... |
| V-14671 | Medium | Network devices must authenticate all NTP messages received from NTP servers and peers. | Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP... |
| V-3043 | Medium | The network device must use different SNMP community names or groups for various levels of read and write access. | Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community... |
| V-14717 | Medium | The network element must not use SSH Version 1 for administrative access. | SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to, e.g., man-in-the-middle attacks, it is now generally... |
| V-3971 | Medium | VLAN 1 must not be used for user VLANs. | In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to communicate with other networking devices using Spanning-Tree Protocol (STP), Cisco Discovery... |
| V-17832 | Medium | The management VLAN is not configured with an IP address from the management network address block. | If the management systems reside within the same layer 2 switching domain as the managed network elements, then separate VLANs will be deployed to provide separation at that level. In this case,... |
| V-5613 | Medium | The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface. | An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens... |
| V-3057 | Medium | Authorized accounts must be assigned the least privilege level necessary to perform assigned duties. | By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those... |
| V-3160 | Medium | The network element must be running a current and supported operating system with all IAVMs addressed. | Network devices that are not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software... |
| V-15432 | Medium | Network devices must use two or more authentication servers for the purpose of granting administrative access. | The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in... |
| V-3013 | Medium | Network devices must display the DoD-approved logon banner warning. | All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear... |
| V-5646 | Medium | The network device must drop half-open TCP connections through filtering thresholds or timeout periods. | A TCP connection consists of a three-way handshake message sequence. A connection request is transmitted by the originator, an acknowledgement is returned from the receiver, and then an acceptance... |
| V-3058 | Medium | Unauthorized accounts must not be configured for access to the network device. | A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that... |
| V-14669 | Medium | The administrator must ensure BSD r command services are disabled. | Berkeley Software Distribution (BSD) “r” commands allow users to execute commands on remote systems using a variety of protocols. The BSD "r" commands (e.g., rsh, rlogin, rcp, rdump, rrestore,... |
| V-28784 | Medium | A service or feature that calls home to the vendor must be disabled.
| Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that... |
| V-5628 | Medium | A dedicated management VLAN or VLANs must be configured to keep management traffic separate from user data and control plane traffic. | All ports, including the internal sc0 interface, are configured by default to be members of VLAN 1. In a VLAN-based network, switches use VLAN 1 as the default VLAN for in-band management and to... |
| V-3969 | Medium | The network device must only allow SNMP read-only access. | Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations. |
| V-5624 | Medium | The ISSO/NSO will ensure if 802.1x Port Authentication is implemented, re-authentication must occur every 60 minutes. | Eliminating unauthorized access to the network from inside the enclave is vital to keeping a network secure. Internal access to the private network is enabled by simply connecting a workstation or... |
| V-5622 | Medium | The native VLAN must be assigned to a VLAN ID other than the default VLAN for all 802.1q trunk links. | VLAN hopping can be initiated by an attacker who has access to a switch port belonging to the same VLAN as the native VLAN of the trunk link connecting to another switch in which the victim is... |
| V-3966 | Medium | In the event the authentication server is unavailable, the network device must have a single local account of last resort defined. | Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when... |
| V-17824 | Medium | The management interface is an access switchport and has not been assigned to a separate management VLAN. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the... |
| V-17826 | Medium | The access switchport connecting to the OOBM access switch is not the only port with membership to the management VLAN. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the... |
| V-17820 | Medium | The OOBM access switch is not physically connected to the managed network element OOBM interface. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element must be directly connected to the OOBM... |
| V-17821 | Medium | Managed NE OOBM interface is not configured with an OOBM network address. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM... |
| V-18566 | Medium | The switch must only allow a maximum of one registered MAC address per access port. | Limiting the number of registered MAC addresses on a switch access port can help prevent a CAM table overflow attack. This type of attack lets an attacker exploit the hardware and memory... |
| V-5623 | Medium | Port trunking must be disabled on all access ports (do not configure trunk on, desirable, non-negotiate, or auto--only off). | Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victims MAC address and with the victim attached to... |
| V-3984 | Medium | Access switchports must not be assigned to the native VLAN. | Double encapsulation can be initiated by an attacker who has access to a switch port belonging to the native VLAN of the trunk port. Knowing the victim's MAC address and with the victim attached... |
| V-5611 | Medium | The network element must only allow management connections for administrative access from hosts residing in to the management network. | Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted... |
| V-3967 | Medium | The network element must time out access to the console port after 10 minutes or less of inactivity. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port... |
| V-5612 | Medium | The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions. | An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and... |
| V-3014 | Medium | The network element must timeout management connections for administrative access after 10 minutes or less of inactivity. | Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components. |
| V-3972 | Low | VLAN 1 must be pruned from all trunk and access ports that do not require it. | VLAN 1 is a special VLAN that tags and handles most of the control plane traffic such as Spanning-Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN... |
| V-3973 | Low | Disabled switch ports must be placed in an unused VLAN (do not use VLAN1). | It is possible that a disabled port that is assigned to a user or management VLAN becomes enabled by accident or by an attacker and as a result gains access to that VLAN as a member. |
| V-4584 | Low | The network element must log all messages except debugging and send all log data to a syslog server. | Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service... |
| V-23747 | Low | The network element must use two or more NTP servers to synchronize time. | Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If you cannot successfully compare logs between each of your routers, switches,... |
| V-3020 | Low | The network element must have DNS servers defined if it is configured as a client resolver. | The susceptibility of IP addresses to spoofing translates to DNS host name and IP address mapping vulnerabilities. For example, suppose a source host wishes to establish a connection with a... |
| V-3079 | Low | The network element must have the Finger service disabled. | The finger service supports the UNIX finger protocol, which is used for querying a host about the users that are logged on. This service is not necessary for generic users. If an attacker were to... |
| V-3078 | Low | Network devices must have TCP and UDP small servers disabled. | Cisco IOS provides the "small services" that include echo, chargen, and discard. These services, especially their User Datagram Protocol (UDP) versions, are infrequently used for legitimate... |
| V-17825 | Low | An address has not been configured for the management VLAN from space belonging to the OOBM network assigned to that site. | The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the... |
| V-17827 | Low | The management VLAN is not pruned from any VLAN trunk links belonging to the managed network’s infrastructure.
| The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the... |
| V-3072 | Low | The running configuration must be synchronized with the startup configuration after changes have been made and implemented. | If the running and startup router configurations are not synchronized properly and a router malfunctions, it will not restart with all of the recent changes incorporated. If the recent changes... |
| V-18544 | Low | Printers must be assigned to a VLAN that is not shared by unlike devices. | Aspects of hardening the network wall plate may include traffic filtering or restrictions on connectivity to enforce a device-, community of interest-, or user-specific security policy. For... |
| V-5615 | Low | Network devices must have TCP Keep-Alives enabled for TCP sessions. | Idle TCP sessions can be susceptible to unauthorized access and hijacking attacks. By default, routers do not continually test whether a previously connected TCP endpoint is still reachable. If... |
| V-5614 | Low | Network devices must have the PAD service disabled. | Packet Assembler Disassembler (PAD) is an X.25 component seldom used. It collects the data transmissions from the terminals and gathers them into a X.25 data stream and vice versa. PAD acts like... |
| V-7011 | Low | The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication. | The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. ... |
| V-18565 | Low | The IAO will ensure that all switchports configured using MAC port security will shutdown upon receiving a frame with a different layer 2 source address than what has been configured or learned for port security. | The Port Security feature remembers the Ethernet MAC address connected to the switch port and allows only that MAC address to communicate on that port. If any other MAC address tries to... |
| V-3070 | Low | The network element must log all attempts to establish a management connection for administrative access. | Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders... |
