Network Hardening

• A single unpatched management interface or default SNMP community undoes months of perimeter design.
• Hardening baselines are auditable evidence; auditors want copies of the exact config, not a promise.
• Repeatable baselines (via ansible/puppet/infrastructure-as-code) stop configuration rot compounding silently.

You cannot just paint the boiler room; you must also replace the rusted valves on a schedule.

• Service minimization: disable telnet, HTTP/S on the mgmt plane, TFTP, and unneeded daemons before first boot.
• Access restriction: management reach limited to dedicated jump hosts/NACLs; SSH with keys, no password auth.
• Authentication + RBAC: per-user accounts with roles, MFA on admin plane, and centralized logs as the true state of the device.
• Change control and baselines: configs stored in VCS/Ansible, drift-checked nightly, patched within an agreed SLA.

• A data center runs Ansible to push a CIS network baseline to all switches weekly, failing any drift in CI.
• An org gates admin access on their network gear through a secret-managed bastion and short-lived SSH certificates.
• A healthcare system maintains a golden image for all APs including default-deny ACLs and disabled management probes.

• Start from 'deny now, document exceptions' rather than the vendor's 'all-open by default' config.
• Restrict management to point-to-point links/bastion with ACLs; never manage switches from the office Wi-Fi.
• Enforce SSH keys + MFA on admin planes; disable password-based SSH and default/blank SNMP communities.
• Version-control configs, enforce drift checks, and patch on a scheduled SLA with a rollback path.

• Hardening the perimeter firewall but leaving the old access switch and its default telnet fully open.
• Enabling SNMP 'for monitoring' with community public, which announces your entire network to an attacker.
• Using one shared admin account across all devices so revocation = reconfiguring the world.
• Hardening once, then letting a single 'temporary' change rot for two years — hardening that decays isn't hardening.

• When an admin box suddenly loses connectivity, check ACL order — a log-any-any placed before your allow breaks everything.
• Use the config-diff from your Ansible run to spot drift before it becomes an outage.
• After service minimization, run a quick internal scan of your own mgmt plane to confirm the tightening stuck.

• Only harden and scan infrastructure you own; red-team style testing of others' devices is off-limits without written scope.
• Keep an audit trail: every config change, justification, and approver recorded.
• Do not hide 'temporary' red rules; each must carry an owner and an expiry.