1 1 00:00:00,490 --> 00:00:02,570 Securing SNMP. 2 2 00:00:02,570 --> 00:00:05,550 In this lesson, we're going to discuss how we can best secure 3 3 00:00:05,550 --> 00:00:08,870 the Simple Network Management Protocol or SNMP. 4 4 00:00:08,870 --> 00:00:12,220 SNMP is a great helper protocol inside of our networks 5 5 00:00:12,220 --> 00:00:13,980 and allows us to easily gather information 6 6 00:00:13,980 --> 00:00:15,440 from various network devices 7 7 00:00:15,440 --> 00:00:17,810 back to our centralized management server. 8 8 00:00:17,810 --> 00:00:21,100 In the past, SNMP relied on the use of a secure string 9 9 00:00:21,100 --> 00:00:23,930 called a community string to grant access to portions 10 10 00:00:23,930 --> 00:00:25,710 of the device management planes. 11 11 00:00:25,710 --> 00:00:28,910 This led to widespread abuse of SNMP by attackers though, 12 12 00:00:28,910 --> 00:00:30,850 because it allowed them to gain access and control 13 13 00:00:30,850 --> 00:00:32,420 over network devices. 14 14 00:00:32,420 --> 00:00:35,540 So our first step to securing SNMP in your network 15 15 00:00:35,540 --> 00:00:40,540 is to ensure you are not using SNMP v1 or SNMP v2. 16 16 00:00:40,890 --> 00:00:43,140 This is because both version 1 and version 2, 17 17 00:00:43,140 --> 00:00:45,930 use an insecure version of a community string. 18 18 00:00:45,930 --> 00:00:48,190 The only version of SNMP that you should be using 19 19 00:00:48,190 --> 00:00:50,390 is version 3, because it adds the ability 20 20 00:00:50,390 --> 00:00:53,930 to use authentication and encryption of your SNMP payloads 21 21 00:00:53,930 --> 00:00:56,040 as they're being sent across the network. 22 22 00:00:56,040 --> 00:00:59,210 SNMP instead is going to use encoded parameters to provide 23 23 00:00:59,210 --> 00:01:02,310 its authentication as part of the SNMP architecture. 24 24 00:01:02,310 --> 00:01:05,880 By using SNMP V3, instead of V1 or V2, 25 25 00:01:05,880 --> 00:01:07,990 you're going to prevent replay, on path 26 26 00:01:07,990 --> 00:01:10,786 or men in the middle attacks of your SNMP architecture. 27 27 00:01:10,786 --> 00:01:14,760 Now this alone isn't enough to call SNMP V3 secure though, 28 28 00:01:14,760 --> 00:01:16,510 because hackers can continue to find ways 29 29 00:01:16,510 --> 00:01:19,680 to abuse the protocol and use it for their own advantages. 30 30 00:01:19,680 --> 00:01:21,300 To better secure SNMP, 31 31 00:01:21,300 --> 00:01:23,820 you should also combine the use of SNMP V3 32 32 00:01:23,820 --> 00:01:26,070 with using whitelisting of the management information base 33 33 00:01:26,070 --> 00:01:29,400 or MIB by implementing different SNMP views. 34 34 00:01:29,400 --> 00:01:31,970 This will ensure that even if the credentials are exploited, 35 35 00:01:31,970 --> 00:01:33,670 your information can not be read from a device 36 36 00:01:33,670 --> 00:01:36,130 or written to a device, unless the information is needed 37 37 00:01:36,130 --> 00:01:37,530 as part of normal monitoring 38 38 00:01:37,530 --> 00:01:40,240 or normal device reconfiguration techniques. 39 39 00:01:40,240 --> 00:01:43,040 Some other solutions to help you secure SNMP V3, 40 40 00:01:43,040 --> 00:01:45,510 is use authPriv on all your devices. 41 41 00:01:45,510 --> 00:01:48,410 This will include authentication and encryption features. 42 42 00:01:48,410 --> 00:01:49,340 For this to work, 43 43 00:01:49,340 --> 00:01:51,220 you need to use a newer network device though 44 44 00:01:51,220 --> 00:01:53,600 that supports a cryptographic feature set. 45 45 00:01:53,600 --> 00:01:55,190 Also, you need to ensure that 46 46 00:01:55,190 --> 00:01:57,410 all of your SNMP administrative credentials 47 47 00:01:57,410 --> 00:01:59,360 are being configured with strong passwords 48 48 00:01:59,360 --> 00:02:01,500 for authentication and encryption. 49 49 00:02:01,500 --> 00:02:04,060 You should also follow the principles of least privilege. 50 50 00:02:04,060 --> 00:02:05,620 This includes using role separation 51 51 00:02:05,620 --> 00:02:07,820 between polling and receiving traps for reading, 52 52 00:02:07,820 --> 00:02:09,790 and configuring users or groups for writing, 53 53 00:02:09,790 --> 00:02:12,730 because many SNMP managers require login credentials 54 54 00:02:12,730 --> 00:02:15,230 to be stored on the disk in order to receive traps 55 55 00:02:15,230 --> 00:02:16,610 from an agent. 56 56 00:02:16,610 --> 00:02:19,640 Access control lists, or ACL's should also be applied 57 57 00:02:19,640 --> 00:02:21,740 and extended to block unauthorized computers 58 58 00:02:21,740 --> 00:02:24,420 from accessing the SNMP management network devices. 59 59 00:02:24,420 --> 00:02:27,870 Access to devices with read and or write SNMP permissions 60 60 00:02:27,870 --> 00:02:29,370 should be strictly controlled 61 61 00:02:29,370 --> 00:02:31,520 to ensure the security of your network. 62 62 00:02:31,520 --> 00:02:33,520 When it comes to your SNMP traffic, 63 63 00:02:33,520 --> 00:02:36,150 I recommend that you segregate out your SNMP traffic 64 64 00:02:36,150 --> 00:02:39,380 onto a separate management network or a separate VLAN. 65 65 00:02:39,380 --> 00:02:41,640 Preferably, you're going to use a management network 66 66 00:02:41,640 --> 00:02:44,600 that's out of ban, if you can afford to design it that way, 67 67 00:02:44,600 --> 00:02:46,800 if not, you're going to need to logically separate 68 68 00:02:46,800 --> 00:02:49,130 the SNMP traffic into a separate VLAN 69 69 00:02:49,130 --> 00:02:51,170 to keep it secure at a minimum. 70 70 00:02:51,170 --> 00:02:54,870 Finally, remember that an MIB and SNMP measurement devices 71 71 00:02:54,870 --> 00:02:56,500 are just another type of server, 72 72 00:02:56,500 --> 00:02:57,660 and so you need to make sure you keep 73 73 00:02:57,660 --> 00:03:00,100 those system images and software up-to-date 74 74 00:03:00,100 --> 00:03:01,730 in terms of its software and firmware 75 75 00:03:01,730 --> 00:03:03,680 using good patch management principles.