V-273672

Discussion

A compromised switch introduces risk to the entire network infrastructure as well as data resources that are accessible via the network. The perimeter defense has no oversight or control of attacks by malicious users within the network. Preventing network breaches from within is dependent on implementing a comprehensive defense-in-depth strategy, including securing each device connected to the network. This is accomplished by following and implementing all security guidance applicable for each node type. A fundamental step in securing each switch is to enable only the capabilities required for operation.

Check Content

Review the switch configuration to determine if services or functions not required for operation, or not related to switch functionality, are enabled. 

1. Check that web authentication is enabled.
Router#show webauth
The result returned will be blank.

2. Check that web services are enabled.
Router#show web
HTTP server status: Disabled
HTTPS server status: Disabled
No web connection.

3. Check if the telnet service is enabled.
Router#show telnet
Telnet server status: Disabled
Telnet connections:

4. Check if the tftp service is enabled.
Router#show running-config | include tftp
no tftp client enable
tftp disable

If unnecessary services and functions are enabled on the switch, this is a finding.