-: Securing SNMP. 2 2
In this lesson, we're going to discuss how we can best secure 3 3
the Simple Network Management Protocol or SNMP. 4 4
SNMP is a great helper protocol inside of our networks 5 5
and allows us to easily gather information 6 6
from various network devices 7 7
back to our centralized management server. 8 8
In the past, SNMP relied on the use of a secure string 9 9
called a community string to grant access to portions 10 10
of the device management planes. 11 11
This led to widespread abuse of SNMP by attackers though, 12 12
because it allowed them to gain access and control 13 13
over network devices. 14 14
So our first step to securing SNMP in your network 15 15
is to ensure you are not using SNMP v1 or SNMP v2. 16 16
This is because both version 1 and version 2, 17 17
use an insecure version of a community string. 18 18
The only version of SNMP that you should be using 19 19
is version 3, because it adds the ability 20 20
to use authentication and encryption of your SNMP payloads 21 21
as they're being sent across the network. 22 22
SNMP instead is going to use encoded parameters to provide 23 23
its authentication as part of the SNMP architecture. 24 24
By using SNMP V3, instead of V1 or V2, 25 25
you're going to prevent replay, on path 26 26
or men in the middle attacks of your SNMP architecture. 27 27
Now this alone isn't enough to call SNMP V3 secure though, 28 28
because hackers can continue to find ways 29 29
to abuse the protocol and use it for their own advantages. 30 30
To better secure SNMP, 31 31
you should also combine the use of SNMP V3 32 32
with using whitelisting of the management information base 33 33
or MIB by implementing different SNMP views. 34 34
This will ensure that even if the credentials are exploited, 35 35
your information can not be read from a device 36 36
or written to a device, unless the information is needed 37 37
as part of normal monitoring 38 38
or normal device reconfiguration techniques. 39 39
Some other solutions to help you secure SNMP V3, 40 40
is use authPriv on all your devices. 41 41
This will include authentication and encryption features. 42 42
For this to work, 43 43
you need to use a newer network device though 44 44
that supports a cryptographic feature set. 45 45
Also, you need to ensure that 46 46
all of your SNMP administrative credentials 47 47
are being configured with strong passwords 48 48
for authentication and encryption. 49 49
You should also follow the principles of least privilege. 50 50
This includes using role separation 51 51
between polling and receiving traps for reading, 52 52
and configuring users or groups for writing, 53 53
because many SNMP managers require login credentials 54 54
to be stored on the disk in order to receive traps 55 55
from an agent. 56 56
Access control lists, or ACL's should also be applied 57 57
and extended to block unauthorized computers 58 58
from accessing the SNMP management network devices. 59 59
Access to devices with read and or write SNMP permissions 60 60
should be strictly controlled 61 61
to ensure the security of your network. 62 62
When it comes to your SNMP traffic, 63 63
I recommend that you segregate out your SNMP traffic 64 64
onto a separate management network or a separate VLAN. 65 65
Preferably, you're going to use a management network 66 66
that's out of ban, if you can afford to design it that way, 67 67
if not, you're going to need to logically separate 68 68
the SNMP traffic into a separate VLAN 69 69
to keep it secure at a minimum. 70 70
Finally, remember that an MIB and SNMP measurement devices 71 71
are just another type of server, 72 72
and so you need to make sure you keep 73 73
those system images and software up-to-date 74 74
in terms of its software and firmware 75 75
using good patch management principles.