| 5.5 |  | Managing the Router |
| 5.5.4 |  | Testing and security validation |

| The perimeter router is the first line of defense when protecting against malicious attack. However, routers provide many services that can have severe security implications if improperly configured. Some of these services are enabled by default. Other services are enabled by users. Security testing provides a means of verifying that security functions and system operations are configured in a secure manner. Ideally, testing should be performed at initial deployment of a router, and whenever major changes have been made to the any part of the configuration of a router.

Testing tools
There are a variety of tools available for testing purposes. Scanners such as the Fyodor Nmap and Nessus are used to scan for open TCP and UDP ports on a router interface. The Center for Internet Security (CIS) has developed the Router Audit Tool (RAT) for auditing Cisco router configuration files. The RAT is based on the CIS Benchmark for Cisco IOS Routers, a consensus-based best practice guideline for hardening Cisco routers. The RAT is available for the Windows or UNIX operating systems. A sample RAT output is shown in Figure . Finally, the cisco Output Interpreter is a tool that analyzes Cisco router or Cisco PIX configurations and displays potential security issues and recommends security fixes.

Also, packet sniffer programs can be used to monitor traffic passing through the network and steal unencrypted passwords and SNMP community strings. This information can then be used to formulate specific attacks against the router. Attack scripts are readily available on the Internet for numerous well-known exploits. Several denial of service (DoS) attacks and the newer distributed denial of service (DDoS) attacks have been highly successful against some versions of IOS.

| Web Links VA Linux http://ncat.sourceforge.net/ Nessus http://www.nessus.org/

NMAP
http://www.insecure.org/nmap/

RAT - Center for Internet Security
http://www.cisecurity.org/