1

I am currently looking into cybersecurity for small businesses and it is something I have become very interested in. One of the questions in the questionnaire is:

  1. Confirm that any remote administrative interface has been disabled on all firewall (or similar) devices

I have been looking at remote access and I can only seem to find ways how to configure it. I was curious on the security issues this poses. I presume that it requires more ports to be open for this to work? What other security implications does this cause?

1 Answer 1

4

Basically every "remote access" feature is a potential attack vector, allowing a malicious actor to perform attacks on your device.

For example, if you have a outdated cisco firewall, even if you have the most complex password, an malicious attacker could perform a buffer overflow on the authentication step and maybe get access to your server.

Few recommendations would be:

  • Disable any insecure protocol on your device (Telnet, FTP, etc..), keep only SSH or encrypted protocols.
  • Implement whitelists to allow only very specific IPs to connect to the SSH. Never leave remote-access ports open to the internet or to non-trusted networks;
  • If it's possible, implement a secure jump server, to ensure only authorized people will have access to the SSH interface of the device. If you have a jumpserver, the only IP that should have access to the SSH interface of the firewall should be the jump server IP.
  • Keep a good access management practice, ensure password complexity and enforce password expiration for user-accounts.
2
  • 1
    I would add regular password expiry to that last point too!
    – essefbx
    Feb 6, 2017 at 22:11
  • Good idea, I just edited to include that Feb 7, 2017 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .