Router & Switch Security Standard

Scope:

This standard describes a required minimal security configuration for all routers and switches connecting to a production network or used in a production capacity at or on behalf of Loyola University Chicago.

Purpose:

All routers and switches connected to Loyola University Chicago production networks are affected. This document is broken in to two sections: Baseline routers and switches, and Perimeter routers and switches. All routers and switches will be configured to the baseline standard, perimeter devices have additional required controls.

Standard:

Baseline:

1. No local user accounts are configured on the router. Routers must use RADIUS for all user authentication.
2. The enable password on the router must be kept in a secure encrypted form. The router must have the enable password set to the current production router password from the router's support organization.
3. Disallow the following:
   1. IP directed broadcasts
   2. TCP small services
   3. UDP small services
   4. All web services running on router
   5. Switch interfaces set with “dynamic” port negotiation
4. Use SNMPv3 and AES.
5. All routing updates shall be done using secure routing updates.
6. Access control lists are to be added and modified as business needs arise.
7. A primary and backup point of contact must be provided for each router and switch on the University’s networks.
8. Each router must have the following statement posted in clear view:
9. "This computer and network are provided for use by authorized members of the Loyola community. Use of this computer and network are subject to all applicable Loyola policies, including Information Technology Services policies, and any applicable Loyola Handbooks. Any use of this computer or network constitutes acknowledgment that the user is subject to all applicable policies. Any other use is prohibited.
10. Users of any networked system, including this computer, should be aware that due to the nature of electronic communications, any information conveyed via a computer or a network may not be private. Sensitive communications should be encrypted or communicated via an alternative method."
11. Telnet may never be used across any network to manage a router, unless there is a secure tunnel protecting the entire communication path. SSH is the preferred management protocol.
12. Synchronize all clocks through the use of NTP.
13. An audit and logging strategy, based on the ITS Log Management Standard,must be utilized.
14. Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network. This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, Simple Network Management Protocol (SNMP) community strings, etc.)

Perimeter:

1. Disallow the following:
   1. Incoming packets at the router sourced with invalid addresses, such as RFC1918 addresses or the Loyola public IP space
   2. Block IP packets that have the same source and destination
   3. Outgoing packets at the router sourced with invalid addresses, such as RFC1918 addresses
   4. All source routing
   5. CDP on Internet connected interfaces
   6. IP directed-broadcast
2. Implement black hole routing, or null routing
3. Disable network auto-loading via TFTP

Exceptions:

Exceptions to this policy will be handled in accordance with the ITS Security Policy.

Review:

This policy will be maintained in accordance with the ITS Security Policy.

Emergencies

In emergency cases, actions may be taken by the Incident Response Team in accordance with the procedures in the ITS Incident Response Plan. These actions may include rendering systems inaccessible.

Appendix

Documents Referenced:

• ITS Security Policy
• ITS Incident Response Plan
• ITS Log Management Standard

References

• CIS Cisco IOS 15 Benchmark v4.1.0

History

• September 12, 2011: Initial Policy
• October 6, 2011: Revised
• October 29, 2012: Annual review for PCI Compliance
• July 17, 2013: Annual review for PCI Compliance
• July 5, 2014: Annual review for PCI Compliance
• August 7, 2014: Added section to comply with PCI-DSS v3.0 Req. 2.1
• May 13, 2015: Annual review for PCI Compliance
• April 19, 2016: Annual review for PCI Compliance
• June 7: 2017: Updated reference and encryption method, annual review for PCI Compliance.
• May 1, 2018: Updated reference, annual review for PCI Compliance
• June 26, 2019: Annual review for PCI Compliance
• May 27, 2020: Annual review for PCI Compliance
• June 28, 2021: Annual review for PCI Compliance, Updated References