Security Compliance Report

Compliance Standards

Security Findings

• VTY Access Control List HIGH
  No ACL on VTY lines. Any IP can attempt SSH/Telnet to device [SOC 2: CC6.1,CC6.6 | NIST: PR.AC-3,PR.PT-4]
  Recommendation: Create ACL and apply: access-class in
• SNMP Security HIGH
  SNMPv2c community strings in use. Community strings sent in cleartext — can be sniffed [SOC 2: CC6.7,CC7.2 | NIST: PR.DS-2,DE.CM-1]
  Recommendation: Migrate to SNMPv3 with authPriv; remove snmp-server community lines
• Routing Protocol Authentication HIGH
  Routing protocols without authentication. Rogue routers can inject false routes [SOC 2: CC6.6 | NIST: PR.DS-2,PR.PT-4]
  Recommendation: Enable MD5/SHA authentication on OSPF/EIGRP/BGP peers
• Console Security MEDIUM
  Console may lack password or timeout. Physical console access should be secured [SOC 2: CC6.1 | NIST: PR.AC-2]
  Recommendation: Configure: line console 0; password ; login; exec-timeout 5 0
• DHCP Snooping MEDIUM
  DHCP snooping not enabled. Network susceptible to rogue DHCP [SOC 2: CC6.6,CC6.8 | NIST: PR.PT-4]
  Recommendation: Enable: ip dhcp snooping; ip dhcp snooping vlan
• Dynamic ARP Inspection MEDIUM
  Dynamic ARP Inspection not enabled. Vulnerable to ARP spoofing / MITM on L2 [SOC 2: CC6.6 | NIST: PR.PT-4]
  Recommendation: Enable: ip arp inspection vlan (requires DHCP snooping)
• Control Plane Protection MEDIUM
  No CoPP / control-plane policy detected. Control plane susceptible to DoS [SOC 2: CC7.1 | NIST: PR.PT-4]
  Recommendation: Apply a control-plane policy to rate-limit management protocols
• NetFlow / sFlow MEDIUM
  No flow telemetry configured. Limited traffic visibility [SOC 2: CC7.1,CC7.2 | NIST: DE.CM-1,DE.AE-1]
  Recommendation: Configure NetFlow or sFlow for traffic analysis
• Configuration Archive MEDIUM
  Partial config change tracking. Archive or change logging missing [SOC 2: CC8.1 | NIST: PR.IP-1]
  Recommendation: Configure: archive; log config
• Privilege Level Management LOW
  All users at default privilege 15. No role-based access differentiation [SOC 2: CC6.3 | NIST: PR.AC-4]
  Recommendation: Create lower-privilege user accounts for operators
• Storm Control LOW
  No storm control configured. Network may be affected by broadcast storms [SOC 2: CC7.1 | NIST: PR.PT-4]
  Recommendation: Configure: storm-control broadcast level 20
• Unused Interfaces Shutdown LOW
  Only 4/36 interfaces shutdown (11%). Unused ports may allow unauthorized access [SOC 2: CC6.6 | NIST: PR.AC-5]
  Recommendation: Review and shutdown unused interfaces

Security Best Practices