Securing a Network — Defense in Depth

15 min In Progress

Learning Objectives

Name the core moves of basic network hardening
Disable Telnet in favor of SSH
Build a config hardening checker

Layered Defense

No single control stops every attack, so you stack them: disable unused ports/services, use AAA, encrypt management traffic (SSH not Telnet), patch regularly, and segment with VLANs. If one layer fails, the next one catches it.

Real Cisco IOS syntax -- forces SSH-only remote management.

line vty 0 4
 transport input ssh
 login local

Practice — Hardening Checklist

Same idea as a Python checker over a config dict.

config = {"telnet_enabled": True, "unused_ports_disabled": False}

if config["telnet_enabled"]:
    print("WARNING: Telnet is enabled -- switch to SSH")
if not config["unused_ports_disabled"]:
    print("WARNING: unused ports are still active")

📝 Exercise: Build a Hardening Auditor

Write a function audit_hardening(config) that checks a device config dict for: telnet_enabled (True = bad), aaa_enabled (False = bad), unused_ports_disabled (False = bad), and patch_level (anything other than 'current' = bad). Return a list of warning strings, empty list if clean.

code.py

devices = [
    {"name": "core-sw1", "telnet_enabled": True, "aaa_enabled": True,
     "unused_ports_disabled": False, "patch_level": "current"},
    {"name": "edge-rtr2", "telnet_enabled": False, "aaa_enabled": False,
     "unused_ports_disabled": True, "patch_level": "outdated"},
]

def audit_hardening(config):
    warnings = []
    if config.get("telnet_enabled"):
        warnings.append("Telnet enabled -- switch to SSH")
    if not config.get("aaa_enabled"):
        warnings.append("AAA not enabled")
    if not config.get("unused_ports_disabled"):
        warnings.append("Unused ports not disabled")
    if config.get("patch_level") != "current":
        warnings.append("Device is not on the current patch level")
    return warnings

for device in devices:
    print(device["name"], "->", audit_hardening(device) or "clean")

Output

← Back to Chapter