Cisco IOS Switch STIG (Y26M01)

21 items · Security · Medium difficulty · 2 hours

Practical STIG steps to secure Cisco IOS switches.

• Download Cisco IOS Switch STIG package and resources

  Get the latest STIG, XCCDF, and automated content from DISA.

• Inventory target switches and record models and IOS versions

  List device model, serial, IOS version, and role for each switch.

• Backup current switch configurations and images

  Save configs and boot images to secure storage before changes.

• Review STIG requirements against device capabilities

  Identify controls not applicable or requiring compensating controls.

• Schedule maintenance window and notify stakeholders

  Plan downtime and approvals for firmware or config changes.

• Update IOS to STIG-approved firmware and patches

  Apply vendor-supplied images that address known vulnerabilities.

• Harden management access

  Group of management hardening tasks for secure admin access.

• Set enable secret using a strong hashed password

  Use strong passphrase and bcrypt/MD5 or better where supported.

• Configure SSH for secure remote management

  Disable legacy SSH versions and enforce strong key lengths.

• Disable Telnet and other insecure management protocols

  Remove or deny inbound Telnet, HTTP, and legacy protocols.

• Configure SNMPv3 with authentication and privacy

  Use SNMPv3 users, auth, and encryption; remove SNMPv1/2c.

• Implement AAA (RADIUS/TACACS+) and enforce least privilege

  Use centralized auth, role-based access, and logging of commands.

• Configure centralized logging and remote syslog with timestamps

  Send logs to secure collectors and set proper timestamps.

• Configure NTP and restrict acceptable time sources

  Point to trusted NTP servers and use authentication where available.

• Implement VLAN and port security: disable unused ports

  Shutdown unused interfaces and apply port-security where needed.

• Configure management-plane and control-plane ACLs

  Restrict who can reach management services and control protocols.

• Disable unnecessary services and features (CDP, HTTP, etc.)

  Turn off protocols/features not required for operation.

• Harden STP and enable BPDU Guard and PortFast where appropriate

  Protect topology and prevent accidental network loops.

• Run STIG compliance scan and remediate findings

  Use automated tools and manual checks to validate compliance.

• Document changes, update inventories, and record justification

  Capture config diffs, approvals, and mitigation rationale.

• Schedule regular audits and enable automated checks

  Plan recurring scans and monitor for configuration drift.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.