CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.1  Devices            9  3.1.10  Network Monitoring / Diagnostics

Security Issues with Network Monitoring Tools 1 3.1.11  Workstations

Finally, we want to say a few words about SNMP, the Simple Network Management Protocol (not a tool) that has been in the news lately, due to the security vulnerabilities inherent in it. As we noted earlier, many hardware devices like routers and switches are equipped with SNMP capability. The SNMP network management protocol is used to query network devices for information such as configuration, traffic and error counter values, etc.

However, it has also been used by hackers, who take advantage of the fact that the primary way an SNMP query authenticates itself to a device is by providing the right “community name” – which the majority of network installations never change from the default, “public”. And those who do change it find that any password still leaves SNMP vulnerable to the same password-sniffing attacks that work on any system transmitting

“secret key” authentication information across the network. Various security flaws in SNMP have recently led vendors to issue software and firmware updates for devices from switches to routers, or to recommend that SNMP be disabled on devices, which are not firmware-upgradeable. SNMPv2 will feature improvements to authentication.

The usual rule applies here: unless you specifically need SNMP, turn it off.

Security Issues with Network Monitoring Tools 1 3.1.11  Workstations