Title

The RUCKUS ICX switch must be configured to disable nonessential capabilities. (Cat II impact)

Discussion

A compromised switch introduces risk to the entire network infrastructure as well as data resources that are accessible via the network. The perimeter defense has no oversight or control of attacks by malicious users within the network. Preventing network breaches from within is dependent on implementing a comprehensive defense-in-depth strategy, including securing each device connected to the network. This is accomplished by following and implementing all security guidance applicable for each node type. A fundamental step in securing each switch is to enable only the capabilities required for operation.

Check Content

Review the switch configuration to determine if services or functions not required for operation, or not related to switch functionality, are enabled. 1. Check that web authentication is enabled. Router#show webauth The result returned will be blank. 2. Check that web services are enabled. Router#show web HTTP server status: Disabled HTTPS server status: Disabled No web connection. 3. Check if the telnet service is enabled. Router#show telnet Telnet server status: Disabled Telnet connections: 4. Check if the tftp service is enabled. Router#show running-config | include tftp no tftp client enable tftp disable If unnecessary services and functions are enabled on the switch, this is a finding.

Fix Text

Remove unneeded services and functions from the switch. Router# configure terminal Router(config)# no telnet server enable vlan 1 Router(config)# no tftp-server Router(config)#web-management disable Router(config)# vlan xxx (xxx = vlan ID) Router(config-vlan-1)#no webauth Router(config)#write memory

Additional Identifiers

Rule ID: SV-273672r1110975_rule

Vulnerability ID: V-273672

Group Title: SRG-NET-000131-L2S-000014

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.