Should you label networking equipment? is this a security risk?

Question

Should you label networking equipment? is this a security risk? if we label all the networking devices within our company with its host names are we potentially giving away info that we should not?

Thoughts?

Answer 1

The usual is to label but not with the company or host names. Instead:

• For police identification, use tagging with an "If found contact xxx phone number" message. Various physical security service companies can provide these as part of their support contract.
• For asset management, use a naming convention which allows you to identify cables, devices and other items, but that doesn't provide an attacker with obvious clues to identify key devices or networks, for example "HO2FFIN4" rather than Head Office 2nd Floor Finance Team Internal Network 4

Answer 2

It's also helpful to ask the opposite question: What is the risk of -not- labelling equipment? Quickly you'll find some issues:

• Can't differentiate between identical switches that are configured for different locations
• Users can't refer authoritatively to hardware when reporting faults (Yeah it's that green thingy by the stairs with no lights on).
• You go out on site to find something months later and don't know which one it is

You seem to imply that the only option is to label with a hostname, which is of course, not the only option. Use an Asset tag of some form, which allows for creativity. E.g. SHA1 the hostname and use the last 10 characters as the asset tag.