Cisco IOS Router STIG (Y26M01) Checklist

22 items · Security · Medium difficulty · 4 hours

Essential steps to harden Cisco IOS routers to STIG standards.

• Backup current router configuration

  Save running-config to startup-config and export a copy to a secure server or repository.

• Verify device inventory and IOS firmware version

  Record model, serial, and exact IOS release to confirm STIG applicability.

• Apply latest approved IOS image if required

  Install vendor-approved images that address security fixes and vulnerabilities.

• Disable unused interfaces

  Administratively shut down interfaces that carry no authorized traffic.

• Disable HTTP, FTP, and Telnet services

  Turn off legacy/cleartext services unless explicitly required and justified.

• Enforce secure management protocols

  Consolidate management on secure channels and restrict access to management plane.

• Enable SSH and disable Telnet

  Use SSH for CLI management; ensure only modern SSH versions/ciphers are allowed.

• Configure AAA authentication and authorization

  Use local or external RADIUS/TACACS+ for authentication and logging of admin access.

• Set login banners and enable password encryption

  Apply legal banner and service password-encryption or secret hashing.

• Configure strong authentication and password policies

  Enforce complex passwords, minimum lengths, and account lockout where supported.

• Implement role-based access control or fine-grained AAA roles

  Assign least-privilege operator roles and avoid shared accounts.

• Configure access control lists for management plane

  Restrict which IPs/networks can reach management services (SSH, SNMP, HTTP(S)).

• Configure secure SNMP settings

  Avoid SNMPv1/v2c; prefer SNMPv3 with auth and encryption.

• Use SNMPv3 with authentication and encryption

  Create SNMPv3 users with strong auth/privacy settings.

• Restrict SNMP access using ACLs

  Only allow management stations to query SNMP.

• Enable and verify NTP synchronization

  Point devices to authenticated, trusted NTP sources for accurate timestamps.

• Configure centralized logging and monitoring

  Send logs to a secure syslog server and enable logging timestamps.

• Set logging host and enable timestamps

  Configure syslog server IPs and log facility levels.

• Enable Control Plane Policing or rate limiting

  Protect control plane from excessive traffic and basic DoS conditions.

• Harden cryptographic settings for management protocols

  Disable weak ciphers, enable TLS for web management, and enforce strong SSH algorithms.

• Run a compliance scan and remediate findings

  Use STIG tools or automated scanners and address high-risk findings first.

• Document configuration changes and update compliance records

  Record changes, store configs, and note STIG check statuses for audits.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.