System and network hardening

Context

Hardening applied layer by layer: switch ports, packet filtering, administrative access and network services, with monitoring on top.

Each measure removes a specific opportunity, from an unknown device plugged into a port to an exposed management service.

Architecture

Defence in depth, layer by layer

Five layers of controls. Access ports on Cisco switches are locked down, packets are filtered statefully with iptables, administrative access is protected and authenticated, unused ports and services are disabled, and an active monitoring policy watches for network anomalies.

What I did

Applied complete port security on Cisco switches: port security, VLAN hardening, DHCP snooping, IP Source Guard and dynamic ARP inspection.
Filtered packets with iptables, with NAT and stateful firewalling.
Protected administrative access: hardened SSH, CDP disabled, AAA authentication.
Hardened critical network services, added local firewalling and disabled unused ports and services.
Set up an active monitoring policy for network anomalies.

Skills demonstrated

Each skill links to the skills map on the home page.