Here are some common network hardening techniques network professionals use:

Network Hardening Techniques

• Secure SNMP Configurations: The sources emphasize using SNMPv3 for network device management because, unlike SNMPv1 and SNMPv2, it supports data encryption and user authentication [1].
• Implement Port Security: This technique helps prevent unauthorized devices from connecting to a network by limiting the number of MAC addresses allowed on a switch port [2]. According to the sources, you can configure this as a whitelist of allowed MAC addresses or a blacklist of addresses that are not allowed to connect [3].
• Enable Dynamic ARP Inspection (DAI): The sources note that DAI helps prevent ARP poisoning and spoofing attacks [4]. These types of attacks allow an attacker to intercept traffic on a network by sending out false ARP messages, which associate the attacker’s MAC address with the IP address of a legitimate device on the network. We discussed ARP poisoning in our conversation about on-path attacks.
• Enable Control Plane Policing (CoPP): This helps secure a device’s control plane, which is responsible for managing how the device operates [4]. CoPP works by filtering out unsolicited traffic that could be used to disrupt the control plane.
• Implement Private VLANs: This technique isolates traffic between devices on a VLAN, even if they are on the same physical switch [5].
• Disable Unneeded Switch Ports: This simple step helps close off potential access points for attackers [5].
• Disable Unnecessary Network Services: Disabling services like Telnet, which sends data in plaintext, can reduce the risk of attackers intercepting sensitive information [6].
• Enforce Strong Passwords: The sources highly recommend requiring complex passwords and using password policies to enforce factors like length, complexity, and expiration [7]. As we discussed, many attacks rely on weak or guessable passwords.
• Implement Patch and Firmware Management: The sources highlight the importance of keeping devices up to date to address known security vulnerabilities [8].
• Implement Access Control Lists (ACLs): ACLs on routers and firewalls provide a way to filter traffic based on various criteria like source/destination IP addresses and ports, adding an extra layer of security to a network [9]. We discussed using ACLs previously in the context of configuring static routes and mitigating DoS attacks.
• Use a Security Information and Event Management (SIEM) System: SIEMs aggregate log data from various sources on a network, making it easier for security professionals to detect and respond to security events in real time [10].