3 ms·
Do we really need half of the features pre-installed on our cisco devices. Like honestly- I really wish I could "tune" my ios firmware and remove things I dont
by crmrc114 7y ago
Do we really need half of the features pre-installed on our cisco devices. Like honestly- I really wish I could "tune" my ios firmware and remove things I dont need so I could reduce my attack surface.
Since its not called out clearly in the title this affects cicso's LLDP implementation as well https://go.armis.com/hubfs/White-papers/Armis-CDPwn-WP.pdf https://go.armis.com/hubfs/White-papers/Armis-CDPwn-WP.pdf
- socceroos 7y agoThat's what I was taught to do by my dad. Take the uncompiled kernel, remove every driver and feature from it that you don't use for your use-case and then compile. Then go through hardening steps at each layer, chroot all the things, tripwire, etc. Compile all applications configuring for only the features you're going to use. Get a report on all versions and subscribe to vulnerability mailing lists. And then at the end, understand that you have a system that is still vulnerable so set up a regular cadence of maintenance. It's a bit harder to do these days for various reasons.
- bifrost 7y agoIts fairly easy to turn CDP and LLDP off...