Initial commit
This commit is contained in:
Zhongwei Li
475
commands/review-network-security.md
Normal file
475
commands/review-network-security.md
Normal file
@@ -0,0 +1,475 @@
|
||||
---
|
||||
description: Review network security based on NIST standards
|
||||
argument-hint: Optional network architecture or config files
|
||||
---
|
||||
|
||||
You are initiating a comprehensive network security review using a structured workflow based on NIST (National Institute of Standards and Technology) standards and industry security best practices.
|
||||
|
||||
## Workflow Steps
|
||||
|
||||
### 1. Gather Security Review Requirements
|
||||
|
||||
If the user provides specific information, use that directly. Otherwise, ask the user for:
|
||||
|
||||
**Network Information:**
|
||||
- Network architecture diagrams or descriptions
|
||||
- Configuration files (FRR, interfaces, netplan, SONiC, firewall configs)
|
||||
- Network topology (data center, campus, branch, cloud, hybrid)
|
||||
- Critical assets and data flows
|
||||
|
||||
**Environment Context:**
|
||||
- Criticality level (mission-critical, business-critical, standard)
|
||||
- Exposure (internet-facing, internal, DMZ, management)
|
||||
- Industry and compliance requirements (PCI-DSS, HIPAA, SOC 2, FEDRAMP)
|
||||
- Specific NIST frameworks to align with
|
||||
|
||||
**Security Concerns:**
|
||||
- Known vulnerabilities or weaknesses
|
||||
- Recent security incidents
|
||||
- Specific threats or attack vectors of concern
|
||||
- Third-party security audit findings
|
||||
|
||||
**Scope:**
|
||||
- Full infrastructure review or specific components
|
||||
- Focus areas (access control, encryption, routing, etc.)
|
||||
- Depth of review (high-level vs deep technical)
|
||||
|
||||
### 2. Launch network-security-reviewer Agent
|
||||
|
||||
Use the Task tool to launch the network-security-reviewer agent with a comprehensive prompt:
|
||||
|
||||
```
|
||||
Perform a comprehensive NIST-based security review of the following network:
|
||||
|
||||
Network Type: [data center/campus/branch/etc.]
|
||||
Criticality: [mission-critical/business-critical/standard]
|
||||
Exposure: [internet-facing/internal/DMZ]
|
||||
Compliance Requirements: [PCI-DSS/HIPAA/SOC 2/NIST CSF/etc.]
|
||||
|
||||
Network Architecture and Configurations:
|
||||
[Provide diagrams, descriptions, and configuration files]
|
||||
|
||||
Specific Concerns (if any):
|
||||
[User-specified security concerns]
|
||||
|
||||
Please perform a comprehensive security review based on NIST standards covering:
|
||||
|
||||
1. Network Segmentation and Isolation (NIST SP 800-41, 800-125B)
|
||||
- Trust zone separation
|
||||
- DMZ implementation
|
||||
- VLAN/VRF isolation
|
||||
- Micro-segmentation for critical assets
|
||||
- East-west traffic control
|
||||
|
||||
2. Access Control and Authentication (NIST SP 800-53 AC Family)
|
||||
- Management access security
|
||||
- Authentication mechanisms (MFA, SSH keys, TACACS+)
|
||||
- Authorization and privilege escalation
|
||||
- Session management
|
||||
- Role-based access control
|
||||
|
||||
3. Encryption and Data Protection (NIST SP 800-52, 800-77, 800-113)
|
||||
- Management protocol encryption (SSH vs Telnet)
|
||||
- Routing protocol security
|
||||
- VPN configuration and cipher suites
|
||||
- SNMP security (SNMPv3)
|
||||
- WiFi security (WPA3/WPA2 Enterprise)
|
||||
|
||||
4. Routing Security (Industry Best Practices + NIST)
|
||||
- BGP security (authentication, filtering, RPKI)
|
||||
- OSPF/IS-IS authentication
|
||||
- Route filtering and validation
|
||||
- Prevention of route hijacking
|
||||
- Bogon filtering
|
||||
|
||||
5. Denial of Service Protection (NIST Principles)
|
||||
- Rate limiting and CoPP
|
||||
- SYN flood protection
|
||||
- ICMP rate limiting
|
||||
- Broadcast storm control
|
||||
- Resource limits
|
||||
|
||||
6. Logging, Monitoring, and Auditing (NIST SP 800-53 AU Family)
|
||||
- Centralized logging
|
||||
- Log integrity
|
||||
- NTP synchronization
|
||||
- SNMP monitoring security
|
||||
- NetFlow/sFlow analysis
|
||||
- Retention policies
|
||||
|
||||
7. Interface and Service Security (Attack Surface Reduction)
|
||||
- Unused interfaces shutdown
|
||||
- Unnecessary services disabled
|
||||
- Port security
|
||||
- DHCP snooping
|
||||
- Dynamic ARP Inspection
|
||||
|
||||
8. Management Plane Security (NIST Principles)
|
||||
- Out-of-band management
|
||||
- Management network isolation
|
||||
- Encrypted protocols only
|
||||
- Jump host/bastion architecture
|
||||
- Console security
|
||||
|
||||
9. Firmware and Configuration Management (NIST SP 800-53 CM Family)
|
||||
- Patch management
|
||||
- Configuration baselines
|
||||
- Change control
|
||||
- Vulnerability scanning
|
||||
- CIS benchmark compliance
|
||||
|
||||
10. NIST Compliance Mapping (CSF or SP 800-53)
|
||||
- Map controls to NIST framework
|
||||
- Identify compliance gaps
|
||||
- Document deviations
|
||||
- Provide remediation roadmap
|
||||
|
||||
Provide output in the following format:
|
||||
- Executive summary with overall risk assessment
|
||||
- Critical/High/Medium/Low findings with NIST references
|
||||
- Compliance matrix
|
||||
- Remediation roadmap with priorities
|
||||
- Validation commands
|
||||
```
|
||||
|
||||
### 3. Analyze Security Review Output
|
||||
|
||||
When the agent returns the review, organize by:
|
||||
- **Critical Findings**: Immediate security risks requiring urgent action
|
||||
- **High Findings**: Significant vulnerabilities to fix soon
|
||||
- **Medium Findings**: Security improvements needed
|
||||
- **Low Findings**: Best practice enhancements
|
||||
|
||||
### 4. Create Security Assessment Report
|
||||
|
||||
Structure the security findings in a comprehensive report:
|
||||
|
||||
**Executive Summary:**
|
||||
- Overall Security Posture (Critical Risk / High Risk / Medium Risk / Low Risk)
|
||||
- Number of findings by severity
|
||||
- Top 5 critical security gaps
|
||||
- NIST compliance status
|
||||
- Key recommendations
|
||||
|
||||
**Risk Assessment Matrix:**
|
||||
```
|
||||
| Finding | Severity | NIST Control | Likelihood | Impact | Risk Score |
|
||||
|---------|----------|--------------|------------|--------|------------|
|
||||
| ... | Critical | AC-2 | High | High | 9/10 |
|
||||
```
|
||||
|
||||
**Detailed Findings:**
|
||||
For each security issue:
|
||||
```
|
||||
[SEVERITY] Category: Finding Title
|
||||
|
||||
NIST Reference: SP 800-53 XX-Y / CSF Category
|
||||
|
||||
Location: <device/config section>
|
||||
|
||||
Vulnerability:
|
||||
<Description of the security issue>
|
||||
|
||||
Risk:
|
||||
<Potential impact and exploitation scenario>
|
||||
|
||||
Evidence:
|
||||
<Configuration excerpt or observation>
|
||||
|
||||
Attack Vector:
|
||||
<How this could be exploited>
|
||||
|
||||
Recommendation:
|
||||
<Specific remediation steps with examples>
|
||||
|
||||
NIST Compliance:
|
||||
<How remediation addresses NIST requirements>
|
||||
|
||||
Priority: [Immediate/30 days/90 days]
|
||||
```
|
||||
|
||||
### 5. Map to NIST Cybersecurity Framework
|
||||
|
||||
Create CSF compliance matrix:
|
||||
|
||||
**Identify (ID):**
|
||||
- Asset Management (ID.AM)
|
||||
- Risk Assessment (ID.RA)
|
||||
- Findings and gaps
|
||||
|
||||
**Protect (PR):**
|
||||
- Access Control (PR.AC)
|
||||
- Data Security (PR.DS)
|
||||
- Findings and gaps
|
||||
|
||||
**Detect (DE):**
|
||||
- Anomalies and Events (DE.AE)
|
||||
- Continuous Monitoring (DE.CM)
|
||||
- Findings and gaps
|
||||
|
||||
**Respond (RS):**
|
||||
- Response Planning (RS.RP)
|
||||
- Communications (RS.CO)
|
||||
- Findings and gaps
|
||||
|
||||
**Recover (RC):**
|
||||
- Recovery Planning (RC.RP)
|
||||
- Improvements (RC.IM)
|
||||
- Findings and gaps
|
||||
|
||||
### 6. Create Remediation Roadmap
|
||||
|
||||
Provide prioritized remediation plan:
|
||||
|
||||
**Phase 1: Immediate (0-30 days) - Critical Vulnerabilities**
|
||||
1. Finding: Unencrypted management protocols
|
||||
- Action: Disable Telnet/HTTP, enable SSH/HTTPS only
|
||||
- Owner: Network Security Team
|
||||
- Effort: 2 days
|
||||
- NIST: SC-8, SC-13
|
||||
|
||||
2. Finding: No BGP authentication
|
||||
- Action: Implement MD5 authentication on all BGP sessions
|
||||
- Owner: Network Engineering
|
||||
- Effort: 1 week
|
||||
- NIST: SC-8
|
||||
|
||||
**Phase 2: Short-term (1-3 months) - High Priority**
|
||||
[Continue with high priority items]
|
||||
|
||||
**Phase 3: Medium-term (3-6 months) - Medium Priority**
|
||||
[Continue with medium priority items]
|
||||
|
||||
**Phase 4: Long-term (6-12 months) - Enhancements**
|
||||
[Continue with improvements]
|
||||
|
||||
### 7. Provide Validation Commands
|
||||
|
||||
Include commands to verify security controls:
|
||||
|
||||
**Authentication and Access Control:**
|
||||
```bash
|
||||
# Verify SSH only (no Telnet)
|
||||
show line vty 0 4 | include "transport input"
|
||||
netstat -tuln | grep :23 # Should show no Telnet listener
|
||||
|
||||
# Check AAA configuration
|
||||
show running-config | section aaa
|
||||
show tacacs
|
||||
show radius
|
||||
|
||||
# Verify session timeouts
|
||||
show line vty 0 4 | include "exec-timeout"
|
||||
```
|
||||
|
||||
**Encryption Verification:**
|
||||
```bash
|
||||
# Check routing protocol authentication
|
||||
show running-config | section "router bgp"
|
||||
show ip ospf interface | include "authentication"
|
||||
|
||||
# Verify VPN encryption
|
||||
show crypto ipsec sa
|
||||
show crypto isakmp sa
|
||||
|
||||
# Check SNMPv3
|
||||
show snmp user
|
||||
show running-config | include "snmp-server"
|
||||
```
|
||||
|
||||
**Network Segmentation:**
|
||||
```bash
|
||||
# Verify VLAN configuration
|
||||
show vlan brief
|
||||
show vlan id 100
|
||||
|
||||
# Check ACLs
|
||||
show ip access-lists
|
||||
show running-config | include "access-list"
|
||||
|
||||
# Verify firewall rules (if applicable)
|
||||
iptables -L -n -v
|
||||
nft list ruleset
|
||||
```
|
||||
|
||||
**Logging and Monitoring:**
|
||||
```bash
|
||||
# Check syslog configuration
|
||||
show logging
|
||||
show running-config | include logging
|
||||
|
||||
# Verify NTP
|
||||
show ntp status
|
||||
show ntp associations
|
||||
|
||||
# Check SNMP (should be v3 only)
|
||||
show snmp community # Should be empty or not exist
|
||||
show snmp user
|
||||
```
|
||||
|
||||
**Routing Security:**
|
||||
```bash
|
||||
# BGP prefix filtering
|
||||
show ip bgp neighbors <peer> | include "prefix-list"
|
||||
show ip prefix-list
|
||||
|
||||
# Route authentication
|
||||
show ip bgp neighbors <peer> | include password
|
||||
show ip ospf interface | include auth
|
||||
|
||||
# Check for bogon filtering
|
||||
show ip access-lists | include "deny.*10\.0\.0\.0"
|
||||
```
|
||||
|
||||
### 8. Document Compliance Mapping
|
||||
|
||||
Create NIST SP 800-53 compliance matrix:
|
||||
|
||||
| Control Family | Control | Status | Evidence | Gaps | Remediation |
|
||||
|----------------|---------|--------|----------|------|-------------|
|
||||
| AC (Access Control) | AC-2 Account Management | Partial | TACACS+ configured | No MFA | Implement MFA |
|
||||
| AC-3 Access Enforcement | Non-Compliant | None | No ACLs | Implement ACLs |
|
||||
| SC (System Communications) | SC-8 Transmission Confidentiality | Compliant | SSH only | - | - |
|
||||
| SC-13 Cryptographic Protection | Partial | Strong ciphers | Weak BGP auth | Update to BGP-TCP-AO |
|
||||
| AU (Audit and Accountability) | AU-2 Audit Events | Compliant | Syslog configured | - | - |
|
||||
| AU-6 Audit Review | Partial | Logs collected | No analysis | Implement SIEM |
|
||||
|
||||
## Common Security Vulnerabilities
|
||||
|
||||
### Critical Security Issues
|
||||
|
||||
**Unencrypted Management Protocols:**
|
||||
```
|
||||
Vulnerability: Telnet, HTTP, SNMPv1/v2c in use
|
||||
Risk: Credential theft, man-in-the-middle attacks
|
||||
NIST: SC-8, SC-13
|
||||
Fix: Use SSH, HTTPS, SNMPv3 exclusively
|
||||
```
|
||||
|
||||
**Default or Weak Passwords:**
|
||||
```
|
||||
Vulnerability: Default credentials or weak passwords
|
||||
Risk: Unauthorized access, privilege escalation
|
||||
NIST: IA-5
|
||||
Fix: Strong password policy, key-based authentication
|
||||
```
|
||||
|
||||
**No Routing Protocol Authentication:**
|
||||
```
|
||||
Vulnerability: BGP/OSPF without authentication
|
||||
Risk: Route hijacking, traffic interception
|
||||
NIST: SC-8
|
||||
Fix: Implement MD5 or stronger authentication
|
||||
```
|
||||
|
||||
**No Network Segmentation:**
|
||||
```
|
||||
Vulnerability: Flat network design
|
||||
Risk: Lateral movement, widespread compromise
|
||||
NIST: SC-7
|
||||
Fix: Implement VLANs, firewalls, ACLs
|
||||
```
|
||||
|
||||
### High-Risk Security Issues
|
||||
|
||||
**Missing Logging and Monitoring:**
|
||||
```
|
||||
Vulnerability: Inadequate logging
|
||||
Risk: Inability to detect/respond to incidents
|
||||
NIST: AU-2, AU-6, SI-4
|
||||
Fix: Centralized syslog, SNMP, NetFlow
|
||||
```
|
||||
|
||||
**No Rate Limiting or DoS Protection:**
|
||||
```
|
||||
Vulnerability: No control plane protection
|
||||
Risk: Denial of service attacks
|
||||
NIST: SC-5
|
||||
Fix: Implement CoPP, rate limiting
|
||||
```
|
||||
|
||||
**Weak BGP Security:**
|
||||
```
|
||||
Vulnerability: No prefix filtering, no ROV
|
||||
Risk: Route leaks, prefix hijacking
|
||||
NIST: Best practices
|
||||
Fix: Prefix lists, RPKI validation
|
||||
```
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### Defense in Depth
|
||||
|
||||
**Layer 1: Physical Security**
|
||||
- Console port security
|
||||
- Secure rack access
|
||||
- Environmental controls
|
||||
|
||||
**Layer 2: Network Segmentation**
|
||||
- VLANs and VRFs
|
||||
- Firewalls between zones
|
||||
- DMZ for public services
|
||||
- Micro-segmentation
|
||||
|
||||
**Layer 3: Access Control**
|
||||
- Strong authentication (MFA)
|
||||
- Least privilege access
|
||||
- Role-based access control
|
||||
- Regular access reviews
|
||||
|
||||
**Layer 4: Encryption**
|
||||
- Management traffic encryption
|
||||
- VPN for remote access
|
||||
- Routing protocol authentication
|
||||
- SNMPv3 only
|
||||
|
||||
**Layer 5: Monitoring and Detection**
|
||||
- Centralized logging
|
||||
- Anomaly detection
|
||||
- Traffic analysis
|
||||
- Security event correlation
|
||||
|
||||
**Layer 6: Incident Response**
|
||||
- Response procedures
|
||||
- Escalation paths
|
||||
- Forensics capability
|
||||
- Recovery procedures
|
||||
|
||||
### Security Hardening Checklist
|
||||
|
||||
- [ ] Disable Telnet, enable SSH only
|
||||
- [ ] Disable HTTP, enable HTTPS only
|
||||
- [ ] Use SNMPv3 with encryption
|
||||
- [ ] Configure routing protocol authentication
|
||||
- [ ] Implement BGP prefix filtering
|
||||
- [ ] Configure control plane protection
|
||||
- [ ] Enable logging to central server
|
||||
- [ ] Configure NTP for time sync
|
||||
- [ ] Shutdown unused interfaces
|
||||
- [ ] Disable unnecessary services
|
||||
- [ ] Implement AAA (TACACS+/RADIUS)
|
||||
- [ ] Configure session timeouts
|
||||
- [ ] Use strong passwords or keys
|
||||
- [ ] Implement network segmentation
|
||||
- [ ] Configure ACLs for traffic control
|
||||
- [ ] Enable port security on switches
|
||||
- [ ] Configure DHCP snooping
|
||||
- [ ] Enable Dynamic ARP Inspection
|
||||
- [ ] Implement management VLAN/VRF
|
||||
- [ ] Regular firmware updates
|
||||
|
||||
## Notes
|
||||
|
||||
- Security is a continuous process, not a one-time check
|
||||
- Risk tolerance varies by organization - work with security team
|
||||
- Balance security with operational requirements
|
||||
- Document all security decisions and accepted risks
|
||||
- Revalidate security after any network changes
|
||||
- Keep up with evolving threats and NIST updates
|
||||
- Test security controls regularly
|
||||
|
||||
## Example Task Invocation
|
||||
|
||||
```
|
||||
review-network-security Please review security of our data center network with 10 leaf-spine switches running BGP. We're preparing for SOC 2 audit and need NIST SP 800-53 compliance assessment. Main concerns are BGP security and encryption of management protocols. Configuration files attached.
|
||||
```
|
||||
Reference in New Issue
Block a user