Securely Manage Network Infrastructure
Description
Securely manage network infrastructure. Example implementations include version-controlled-infrastructure-as-code, and the use of secure network protocols, such as SSH and HTTPS.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Enterprise firewall with application visibility, IPS, malware defense, and encrypted traffic analytics
Cisco · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Network Device Compromise via Insecure Management Protocols
ConfidentialityAttackers intercept network device management traffic using insecure protocols (Telnet, HTTP, SNMPv1/v2) to capture administrative credentials, then use those credentials to reconfigure devices, create backdoor access, or disrupt network services.
Unauthorized Network Configuration Changes via Uncontrolled Access
IntegrityNetwork device configurations are modified without version control, change management, or audit trails, and unauthorized changes create security gaps such as opened firewall rules, disabled logging, or new route entries that redirect traffic.
Network Infrastructure Backdoor via Unmonitored Management Plane
ConfidentialityAttackers establish persistent access to network devices through unmonitored management interfaces, creating backdoor accounts or modifying device configurations in ways that persist across reboots and remain undetected.
Vulnerabilities (When Safeguard Absent)
Insecure Network Management Protocols in Use
Network devices are managed using unencrypted protocols (Telnet, HTTP, SNMPv1/v2c) that transmit credentials and configuration data in cleartext, allowing network-positioned attackers to intercept administrative access.
No Version Control or Change Management for Network Configurations
Network device configurations are not managed through version-controlled infrastructure-as-code or change management processes, making it impossible to detect unauthorized changes, roll back misconfigurations, or audit who changed what.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |