| 2.1 |  | General Router and Switch Security |
| 2.1.2 |  | Installation |

| Insecure installation of network routers and switches is an often-overlooked security threat, which, if left unheeded, can have dire results. Software-based security measures alone cannot prevent pre-meditated or even accidental network damage due to poor installations. This section discusses ways to identify and remedy insecure installations.

Before discussing how to secure installations, it is important to make a distinction between low-risk and high-risk devices :

- Low-risk devices - These devices are typically low-end or small office, home office (SOHO) devices, such as the Cisco 800/900/1700 series routers and Cisco switches that are found in environments where access to the physical devices and cabling does not present a high-risk to the corporate network. In these types of installations, it may be physically impossible and even too costly to provide a locked wiring closet for physical device security. In these situations, the IT manager must decide which devices can and cannot be physically secured and at what risk.
- High-risk devices - These mission-critical devices are typically found in larger offices or corporate campuses where tens, hundreds, or even thousands of employees reside or remotely access corporate data. These are usually Cisco Internet routers, Catalyst switches, firewalls, and management systems used to route and control large amounts of data, voice, and video traffic. These devices represent a much higher security threat if physically accessed by disgruntled employees or impacted by negative environmental conditions.

Insecure installation, or “physical access” threats are shown in Figures through .