Network access control, authentication, and secure management

Security threats and control selection

A threat is a possible cause of harm. A vulnerability is a weakness. An exploit takes advantage of a weakness. A mitigation reduces risk. A firewall, a patch and user training address different parts of that picture; none is a guarantee against every attack.

Authentication asks who you are. Authorisation decides what you may do. Accounting records activity. These are the three parts of AAA. RADIUS and TACACS+ are used in centralised access designs, with different protocol behaviours. Local accounts can provide a fallback, but must be protected and maintained.

Basic network security controls

Use individual accounts where possible, least privilege, unique strong passwords, appropriate multifactor authentication and protected management paths. Certificates and biometrics are other identity mechanisms with their own trust and recovery requirements. Physical access and phishing awareness matter too.

SSH encrypts a remote command session; Telnet does not. Restrict management access to intended sources. ACLs filter matching packets, and Layer 2 controls such as DHCP snooping, dynamic ARP inspection and port security protect specific local behaviours. Understand trusted ports before enabling those features. Save configurations and keep a recovery path before changing access rules.