[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.2.a
AP Cybersecurity · Securing Networks
Managerial Controls for Network Security
A configuration standard makes the secure setting the default rather than the exception.
key ideaA configuration standard is a control because it makes the secure setting the default, not the exception.
Matching controls to threats
Network devices ship with conveniences that are attack surface: local accounts, legacy services, permissive defaults. A policy is what turns ‘someone should probably fix that’ into a minimum standard every device must meet.
| Policy requirement | What it removes | Attack it answers |
|---|
| ban local user accounts — use an approved auth server | credentials that live only on the device | a shared or forgotten password nobody rotates |
| disable unnecessary services such as Telnet | unencrypted management access | credentials in cleartext on the wire |
| require a firewall, possibly separate from the router | the assumption that routing implies filtering | malicious traffic entering unfiltered |
| require port security on switches | unlimited MAC addresses per port | MAC flooding and unauthorized devices plugging in |
| define who may use the VPN | unbounded remote access | an unnecessary account becoming a remote foothold |
| require EAP authentication on wireless | open or shared-key joining | adversaries joining the network to attack from within |
Every row is a managerial control that produces a technical outcome. The policy does not stop the attack; it guarantees the setting that does.
Router policyA minimum configuration standard for routers — banning local user accounts, disabling unnecessary services such as Telnet, and requiring a firewall.
Switch policyA minimum standard for switches — banning local accounts and requiring port security.
VPN policyThe minimum security requirements for remote access, including which roles are permitted to use it.
Wireless policyMinimum requirements for wireless networks, including EAP authentication and strong encryption.
Approved authentication serverA central system that authenticates logins, so credentials are managed and revocable in one place.
Layering
Each policy covers a class of device, and the same two ideas recur: centralize identity, and remove what is not needed. A device that meets all four standards is hard to misconfigure by accident.why each clause exists
- Local accounts are banned because they are invisible to central revocation — a leaver's access survives them.
- Telnet and similar legacy services carry credentials in cleartext; disabling them is free.
- A firewall may be a separate device rather than a router feature, and the policy should say which.
- A VPN policy names roles, not individuals, so it stays correct as people change jobs.
Worked analysis
EX 1
Why ban local accounts?
An engineer argues a local admin account on each switch is useful when the authentication server is down. Evaluate.
1
Grant the operational point
It genuinely helps during an outage — that is why the practice exists.
2
State the security cost
The credential is invisible to central management: not rotated, not revoked, often shared.
3
Trace the failure
A leaver, or a leaked password, retains access to every switch with the same local account.
4
Offer the compromise
A break-glass account with a unique long password per device, sealed, audited, and rotated after use.
5
State the principle
Convenience during an outage should not become standing access.
EX 2
Write a VPN policy clause
An organization wants to allow remote access without granting it to everyone. Draft the requirements.
1
Define eligibility by role
List the roles permitted to use the VPN — not names, which go stale.
2
Define the authentication
MFA required, using accounts on the central authentication server.
3
Define what it reaches
VPN users land in a segment, not on the flat internal network.
4
Define review
Access is re-certified periodically; unused accounts are disabled.
5
Note the shape
Each clause is checkable. A policy that says ‘VPN access should be limited’ cannot be audited.
EX 3
Telnet on the core switch
A scan finds Telnet enabled on a core switch alongside SSH. Nobody uses it. Is this worth fixing?
1
Ask what it costs to leave
An extra management path that carries credentials in cleartext.
2
Ask who could use it
Anyone who reaches the management network — including after lateral movement.
3
Ask what it costs to fix
One configuration line, and nothing depends on it.
4
Apply the policy
Disable unnecessary services — this is precisely the clause's purpose.
5
Generalize
Unused services are free to remove and never free to keep.
Check yourself
What does a router security policy typically require?
Show answer
Banning local user accounts so all logins use an approved authentication server, disabling unnecessary services such as Telnet, and requiring a firewall — possibly a device separate from the router.
What does a switch security policy add?
Show answer
The same ban on local accounts, plus a requirement for port security — which limits how many MAC addresses a single port may present and blocks MAC flooding.
What belongs in a VPN policy?
Show answer
The minimum security requirements for employees using a VPN to reach the internal network, including a list of roles permitted to use it.
What does a wireless security policy establish?
Show answer
Minimum requirements for wireless networks — notably requiring users to authenticate through an EAP method, alongside strong encryption.