Network Security · Topic 6 of 7
Device Hardening and Access Control
Harden network devices by closing unused ports and changing defaults, then control access with port security, 802.1X, MAC filtering and DHCP snooping.
- 4 min
- Hardening includes changing defaults, disabling unused ports and services, patching and using secure protocols.
- Shut down unused switch ports and place them in an unused VLAN.
- Port security limits MAC addresses per port and can drop traffic or shut the port on a violation.
What it is
Hardening means reducing the ways a device can be attacked. Network access control (NAC) decides which devices may connect at all, and it checks them before they get access.
Both ideas shrink the attack surface. A hardened device offers little to exploit, and a controlled port refuses unknown devices.
How it works
Device hardening
Out of the box, many devices are open and use well known defaults. Hardening closes those gaps.
| Action | Why it matters |
|---|---|
| Change default passwords and accounts | Default credentials are published and tried first by attackers |
| Disable unused ports and services | Every open port or running service is a possible entry point |
| Use secure protocols | Choose Secure Shell (SSH) over Telnet, and Hypertext Transfer Protocol Secure (HTTPS) over plain Hypertext Transfer Protocol (HTTP), for management |
| Apply patches and firmware updates | Fixes known vulnerabilities |
| Restrict management access | Allow administration only from trusted addresses or networks |
| Disable or shut unused switch ports | Prevents someone plugging in an unknown device |
On switches, unused ports are shut down and placed in an unused virtual LAN (VLAN). This is one of the simplest and most tested steps.
Network access control
NAC admits devices based on identity and health. It combines authentication with checks such as whether a device has current patches and antivirus. A device that fails can be denied or sent to a restricted quarantine network.
Port security
Port security limits which Media Access Control (MAC) addresses can use a switch port. It can set a maximum number of addresses and learn them or take a fixed list.
When an unknown MAC address appears, the switch takes a configured action. The usual options are to drop the traffic, to drop it and log it, or to shut the port down.
802.1X
The Institute of Electrical and Electronics Engineers (IEEE) 802.1X standard requires a device or user to authenticate before the port or wireless connection passes normal traffic. It uses a Remote Authentication Dial In User Service (RADIUS) server to check credentials. Compared with port security, it ties access to an identity instead of just a hardware address.
MAC filtering
MAC filtering allows or denies devices by MAC address. It is simple and often used on wireless access points. It is weak by itself, because MAC addresses can be seen on the network and copied.
| Control | Based on | Strength |
|---|---|---|
| MAC filtering | Hardware address | Weak |
| Port security | Hardware address and limits per port | Moderate |
| 802.1X | User or device credentials | Strong |
Protecting against local network attacks
Dynamic Host Configuration Protocol (DHCP) snooping marks switch ports as trusted or untrusted and drops DHCP server replies from untrusted ports, which stops rogue DHCP servers. It also builds a table of legitimate address bindings.
Dynamic Address Resolution Protocol (ARP) inspection (DAI) uses that table to check ARP messages and drops those that do not match, which stops ARP spoofing.
Key management
Cryptographic keys and passwords must be created, stored, rotated and retired safely. Use strong, unique keys, keep private keys out of shared locations, and change them on a schedule and after a suspected leak.
Revoke access when a person leaves or a device is retired. Poor key handling undermines even strong encryption.
What to remember for the exam
- Hardening includes changing defaults, disabling unused ports and services, patching and using secure protocols.
- Shut down unused switch ports and place them in an unused VLAN.
- Port security limits MAC addresses per port and can drop traffic or shut the port on a violation.
- 802.1X authenticates a device or user before opening the port, using a RADIUS server.
- MAC filtering is easy to bypass because MAC addresses can be copied.
- NAC can check device health and quarantine devices that fail.
- DHCP snooping blocks rogue DHCP servers. Dynamic ARP inspection blocks forged ARP messages.
- Rotate keys and revoke them when needed.
For a question about stopping unknown laptops from using a wall jack, the strongest answer is 802.1X. The simple option of port security helps when you only need to limit MAC addresses.
Common mistakes
Leaving defaults in place. Default passwords and open management services are the first thing attackers try.
Relying on MAC filtering as real security. It deters casual users only.
Confusing port security with 802.1X. Port security limits addresses, while 802.1X authenticates identity.
Trusting every switch port for DHCP. Only ports toward the real DHCP server should be trusted.
Disabling a port in software but leaving the jack live. Also remove or label unused patch cables.
Setting port security to shut a port on violation can take a legitimate user offline, for example after they plug in a small switch or a new phone. Plan the maximum address count with that in mind.
Check yourself
Try these three.
Which standard authenticates a device before its switch port passes traffic?
IEEE 802.1X.
What does DHCP snooping do?
It drops DHCP server replies that arrive on untrusted ports, which stops rogue DHCP servers.
Why is MAC filtering a weak control?
MAC addresses can be observed and copied, so an attacker can imitate an allowed device.
Topic 6 of 7 in Network Security
Test yourself on Network Security
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.