Rapid7 have written up about this on their blog. They are basically saying that if SNMP isn't required, then it should be disabled so the attack surface is reduced, however if it is required then you should upgrade to SNMPv3 as it has security improvements:
- Confidentiality – Encryption of packets to prevent snooping by an
- Integrity – Message integrity to ensure that a
packet has not been tampered while in transit including an optional
packet replay protection mechanism.
- Authentication – to verify that
the message is from a valid source.
@Daisetsu has pointed out that only SNMPv1 and SNMPv2c use a community string. SNMPv3 instead uses an
authentication key, a secret key used for authentication and a
privacy key, a secret key used for encryption. (This can be seen in the RFC section 3.1, 4a and 6a).
Both these keys should be different and complex to make guessing attacks difficult, following similar requirements to those linked in the Rapid7 blog.