-: Unneeded Services, in this lesson, 2 2
we're going to discuss the best practices 3 3
of disabling unneeded services and switch ports 4 4
on our network devices, servers and workstations. 5 5
So, let's first talk about unneeded services. 6 6
Now, before we talk too much about unneeded services, 7 7
it's important to define exactly what a service is 8 8
in case you're not aware. 9 9
Now, a service is a type of application 10 10
that runs in the background 11 11
of the operating system or device 12 12
to perform a specific function. 13 13
For example, on your Windows server, 14 14
if you have a shared printer in your network, 15 15
you might be running a Print Spooler, and this is a service. 16 16
Or you might be running a DHCP server on your network. 17 17
And this allows you to automatically configure 18 18
IP addresses for all your clients. 19 19
This DHCP server is a type of service. 20 20
To ensure the highest levels of security for our network 21 21
and reduce the attack surface of our devices, 22 22
it's important that we disable any services 23 23
that are not needed for business operations. 24 24
For example, if I'm going to be using static IP addresses 25 25
for all my network devices, 26 26
I don't need to have a DHCP server. 27 27
So, I can shut down the DHCP server 28 28
and the associated services on the network for DHCP. 29 29
You see, each service that we're running 30 30
has to be installed on some kind of a device. 31 31
Then that device is now using a valuable disc space, 32 32
and more importantly, it's introducing additional code 33 33
that could contain vulnerabilities. 34 34
So to combat this, 35 35
administrators attempt to practice a concept 36 36
known as least functionality. 37 37
Now least functionality is the process 38 38
of configuring a device, a server or a workstation 39 39
to only provide essential services 40 40
that are required by the user. 41 41
Now, to create an environment of least functionality, 42 42
administrators should disable unneeded services, 43 43
ports and protocols on the network. 44 44
When dealing with hardening of your network devices, 45 45
you may also want to disable infrequently used services 46 46
that could be used by an attacker for malicious purposes. 47 47
Things like a denial of service attack, for instance. 48 48
For example, the Echo service runs on port seven, 49 49
Discard runs on port nine. 50 50
Daytime runs on port 13. 51 51
And Chargen runs on port 19. 52 52
These are all examples of some smaller TCP and UDP services 53 53
that we hardly ever use in modern networks. 54 54
But, if they're enabled, 55 55
you want to make sure they're disabled 56 56
to better harden your devices. 57 57
Now, even if you are running a service on your network, 58 58
you may not need to run it on every single device. 59 59
So, you need to figure out which devices you need it on, 60 60
and disable it on all the other devices, 61 61
because otherwise, it's just additional vulnerabilities 62 62
you're accepting. 63 63
For example, if you're running your DHCP server 64 64
on your windows domain controller, 65 65
then you can disable the DHCP server 66 66
that's built into one of your network devices. 67 67
Or, if you're using DHCP, but you never plan to use BOOTP, 68 68
which is an older dynamic configuration protocol, 69 69
you can disable that on all of your network devices, 70 70
so BOOTP is now disabled. 71 71
The key here is that 72 72
if you're not using a particular service, 73 73
you need to disable it. 74 74
So to help you disable those unneeded services, 75 75
Cisco Network Devices provide the auto secure 76 76
command line interface command 77 77
that will disable any unnecessary services 78 78
while enabling necessary security services 79 79
on your network devices. 80 80
Finally, let's talk about the switch ports 81 81
on your network devices themselves. 82 82
As a best practice, 83 83
if nothing is connected to a given switch port 84 84
on a switch or router, that interface should be disabled. 85 85
To disable a switch port on a router or switch, 86 86
you're going to go into the configuration 87 87
command line interface 88 88
and enter the interface you want to disable 89 89
such as interface FastEthernet 0/1. 90 90
Then you're going to enter the command shutdown. 91 91
At this point, even if somebody plugs a cable 92 92
into FastEthernet 0/1 on that switch port, 93 93
it's not going to do anything 94 94
because that port has been electronically 95 95
shutdown and disabled. 96 96
Now, let's pretend that that switch port 97 97
that goes with FastEthernet 0/1 98 98
is connected to the patch panel. 99 99
And that patch panel is connected to a wall jack 100 100
inside an empty office. 101 101
Your company just hires a new employee, 102 102
and now they're going to put that employee in that office. 103 103
What are you going to do? 104 104
Well, you need to re enable that wall jack. 105 105
So you're going to log back into the switch. 106 106
You're going to go into the 107 107
configuration command line interface, 108 108
and you're going to enter interface FastEthernet 0/1 109 109
and then you're going to enter, no shutdown, that's it. 110 110
The switch port will immediately turn itself back on 111 111
and it's ready to send and receive traffic again. 112 112
So it really doesn't take a lot of effort to turn off 113 113
or turn on when they switch ports. 114 114
That's why it's a best practice to always disable them 115 115
when they're not in use. 116 116
Now, each network device manufacturer 117 117
is going to use their own commands. 118 118
The one I just covered were for Cisco devices, 119 119
because they're most commonly used 120 120
in large business networks. 121 121
If you're going to be using a different brand or manufacturer, 122 122
simply check your manual or Google, 123 123
how to shut down and enable switch ports on those devices. 124 124
After all, even if there's no cables 125 125
connected to a switch port, 126 126
an open switch port is going to represent a vulnerability. 127 127
Think about it this way. 128 128
What would happen if an attacker 129 129
made their way past your security 130 130
and were able to get to where the switch is. 131 131
They could just plug into it 132 132
and immediately have access to the network. 133 133
That would be a really bad thing 134 134
because all the switch ports are enabled by default. 135 135
So we want to make sure we disable 136 136
any of them that we're not using. 137 137
Remember just like an unneeded service, 138 138
if there's an unneeded switch port, 139 139
you should always disable it 140 140
to reduce your attack surface 141 141
and increase the security of your networks.