Defend the Edge: The Critical Importance of Edge Device Security

The Critical Role of Edge Device Security  

Edge devices, such as routers, firewalls and virtual private network gateways, are located at network boundaries and accessible from the public internet or external systems outside of the organization’s control. These devices are prime targets for malicious cyber actors, including advanced persistent threat (APT) and criminal groups. End-of-support (EOS) edge devices are trivial for these actors to exploit as they no longer receive security updates.  

As organizations accumulate tech debt, hardware and software that is EOS and no longer supported, it becomes harder to defend against malicious cyber actors. Edge Devices are the load-bearing pillars of a network and cannot afford to be EOS. Threat actors exploit known vulnerabilities, weak default settings, and misconfigurations in edge devices to gain initial access to networks, move laterally through internal systems, and maintain persistence within victim networks. Such compromises enable threat actors to monitor and manipulate network activity to gain control of critical infrastructure, disrupt operations, and exfiltrate sensitive information while remaining undetected for long periods—in some cases, while prepositioning for future coordinated disruptive or destructive cyberattacks.

Securing these devices is not just a technical necessity, it is critical to safeguarding the operational resilience of our nation. CISA urges all organizations to address edge device vulnerabilities today by immediately replacing EOS edge devices. Organizations should also prioritize procuring replacement hardware and software from manufacturers that apply Secure by Design principles.

Best Practices for Securing Edge Devices

Edge devices are the first line of defense between internal networks and external threats. Strengthening the security of edge devices is critical to protecting your network. Safeguard your organization with the following six core functions of the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0:

Govern

• Establish Accountability: Identify responsible roles on IT teams accountable for edge device security. Update cybersecurity programs to create awareness for edge device threats.  
• Refine Cybersecurity Policy: Refine cybersecurity policy to address edge devices; establish procedures that align to the policy and ensure proper operation, monitoring, and configuration management of edge devices.
• Integrate with Risk Management: Incorporate edge devices into enterprise risk management programs, defining acceptable risk levels and identifying mitigation strategies. Establish and monitor metrics pertaining to edge devices.  

Identify

• Audit Your Network: Create and maintain an asset inventory that captures all edge devices and their EOS dates. See BOD 26-02: Mitigating Risk From End-of-Support Edge Devices for more information.
  • Critical infrastructure owners and operators should refer to CISA’s joint publication Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators.
• Replace EOS Devices and Software: Replace EOS edge device hardware and software identified during the inventory process and track upcoming EOS dates for current edge devices and software via automated reminders.  
  • Procure Secure by Design Devices:  Use the questions in the Secure by Demand guidance to help determine if a vendor is following Secure by Design principles.  Specifically choose edge devices that follow the forensics and logging guidelines detailed in Guidance on Digital Forensics and Protective Monitoring.

Protect

• Implement Strong Authentication: Use robust identity and access management practices, which include enforcing minimum password strengths and implementing phishing-resistant multifactor authentication.
• Secure Credentials and Change Default Credentials: Store credentials securely and immediately change default credentials on new devices.
• Apply Hardening Guidance and Updates: Implement vendor-recommended secure configurations and promptly apply updates to address known vulnerabilities.
• Segment Your Network: Isolate edge devices from critical systems and implement least privilege access controls and zero trust principles.
• Disable Services and Ports: Disable risky and unnecessary services, including Remote Desktop Protocol (RDP), Server Message Block (SMB) protocol version 1,  Simple Network Management Protocol (SNMP), Telnet NetBios, File Transfer Protocols (FTP), Trivial File Transfer Protocol (TFTP),  Secure Shell (SSH), Hyper Text Transfer Protocol (HTTP), and deployment automation features (e.g., SmartInstall and Guest Shell), and close associated ports. If these services have a business function, apply appropriate compensating controls (e.g., deny-by-default allowlist policy, access control list).
• Secure Management Interfaces: Remove any internet-exposed management interfaces or use zero trust capabilities that implement a policy enforcement point separate from the interface itself. See BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces for more information.
• Back up and Test Regularly: Secure and maintain backups of device configurations and firmware to enable quick restoration if compromise occurs.

Detect

• Monitor Traffic: Monitor network traffic for suspicious activity.  
  • Configure and monitor netflow to detect lateral movement from edge devices to internal networks. Search for anomalies involving remote access protocols, including NetBIOS (ports 137, 138, 139), RDP (port 3389), RPC (port 135), SMB (port 445), SSH (port 22), WinRM (ports 5985, 5986), and LDAP (ports 389, 636). Disable or allowlist these protocols using strict deny-by-default access control policies where possible.  
• Monitor Configurations: Monitor edge device configurations and terminal logs for suspicious activity.  
  • Log and monitor terminal logins to identify abuse of unauthorized or compromised accounts.  
  • Periodically poll and audit edge device configurations to detect unauthorized changes such as:  
    • Illicit tunnels  
    • Packet capture settings
    • Static routes  
    • Unsanctioned accounts and authentication methods  
    • Manipulation of cryptographic settings  
    • Reconfiguring remote management or file transfer functionality
  • Monitor running memory and firmware properties for anomalies such as integrity validation failures and unexpected versions and build numbers.  
• Implement Centralized Logging: Implement event logs for edge devices and aggregate logs in a security information and event management system (SIEM). See Best Practices for Event Logging and Threat Detection, and Enhanced Visibility and Hardening Guidance for Communications Infrastructure.
• Proactively Hunt for Suspicious Activity: Search for known indicators of compromise (IOCs) and threat actor tactics, techniques, and procedures (TTPs).
• Establish a Baseline: Monitor the network and set alerts for configuration changes to detect anomalous activity.  

Respond

• Promptly Respond to Suspicious Alerts and Logs: Implement alerting to enable prompt incident response that includes isolating devices, disabling accounts and services, modifying configurations, and blocking malicious traffic. Consider unexpected activity on edge devices to be high-risk and investigate as soon as possible. Suspicious activity includes the following:
  • Configuration changes
  • Reboots
  • Modifications of access control lists
  • Account and password changes
  • Tunnels/traffic forwarding and unauthorized packet capture
  • Outbound connections (web, File Transfer Protocol, remote access protocols)
  • Large data transfers to the internet  
  • Clearing of logs
  • Serialization errors
• Use Eviction Strategies: Implement comprehensive eviction and eradication measures during an incident.
• Report Incidents Immediately: Report cybersecurity incidents using CISA’s Incident Reporting System.

Recover

• Restore From a Safe Backup: Use the last known safe backup or good configuration to restore the system.
• Reset and Reinstall Impacted Devices: Factory reset impacted devices and securely reimage them by reinstalling firmware and software from trusted, verified sources images.