AuditUnit 3 · Topic 3.2
Config audit: which settings break the security policy?
Audit a router and wireless configuration against the security policy.
New to this? Read the topic first: 3.2 Protecting Networks.
Simulation · [3.2.A.1, 3.2.A.2, 3.2.A.4, 3.2.B.1, 3.2.B.3]
Config audit: which settings break the security policy?
This branch office uses one device as its router, switch and wireless access point, so its configuration combines the router, switch and wireless security policies: no local user accounts, no unnecessary services, port security on, users authenticate through the extensible authentication protocol (EAP) to the approved server, WPA3 with the Advanced Encryption Standard (AES), beacon frames off. Tap every setting that breaks the policy. There are 4.
-
Fine. Logins go through the approved authentication server. This is what the policy wants.
-
Red flag. A local user account, with a weak patterned password too. The policy bans local accounts.
-
Red flag. Telnet is an unnecessary service (and sends logins unencrypted). The policy says disable it.
-
Fine. Port security is on: one MAC address per port, which stops MAC flooding.
-
Red flag. WPA2 is not on the list of insecure protocols, but this policy requires WPA3, the strongest wireless encryption. "Personal" mode also uses one shared password instead of EAP authentication to the approved server.
-
Red flag. Beacon broadcasting is on. The policy says disable beacon frames so the network is harder to find.
-
Fine. A firewall is required by the router policy, and it is on.
Go to the topic: 3.2 Protecting Networks