The December 2024 joint guidance on communications infrastructure asks for a separate management network, default deny access lists, modern protocol versions, no default passwords, phishing resistant MFA for administrators, and prompt patching. This checklist turns those steps into things to verify on each device.
Where the list comes from
The guide was published on 4 December 2024 by CISA, the NSA, the FBI, and the cyber agencies of Australia, Canada and New Zealand. It followed reports of compromised telecom networks. The agencies said the activity used existing weaknesses, so the hardening list is mostly basics done consistently.
Reach the device safely
- Use a physically separate out of band management network.
- Allow management access only from dedicated administrative workstations.
- Apply default deny access control lists and log denied traffic.
- Use segmentation, DMZs and VLANs.
- Limit VPN exposure, use strong cryptography, and disable unused VPN features.
Use current protocol versions
The guide names TLS 1.3, SSH version 2 with strong key sizes, and SNMPv3 with encryption and authentication. It also says to disable unnecessary or insecure services and protocols, with Telnet, FTP, TFTP, SNMP v1 and v2c, and discovery protocols (where not needed) as examples.
A quick audit: scan your own management addresses for Telnet, FTP, TFTP and SNMP v1 or v2c. Anything that answers is a ticket.
Fix identity and secrets
- Remove default passwords.
- Store passwords with strong hashing.
- Require phishing resistant multifactor authentication for administrative access.
- Apply least privilege and role based access control.
Keep the software honest
- Verify the integrity of software images before installing them.
- Patch promptly and test updates.
- Track end of life hardware and software, since unsupported devices stop getting fixes.
Vendor specific items
The guide includes Cisco specific steps: disable Smart Install, disable guest shell if it is not needed, disable non-encrypted web management, restrict VTY lines to SSH only, and use stronger password types instead of deprecated ones. If you run other vendors, ask them for their equivalent guidance, since this post cannot cover it.
How to run it
Turn the lists above into a per device scorecard with yes, no and not applicable. Start with the most exposed devices, such as internet facing routers and VPN gateways. Record exceptions with an owner and a date. A device you cannot harden should be isolated, replaced or on a plan.
Common gaps worth checking first
Three gaps turn up often in any network review. Management interfaces reachable from the general user network. Shared administrator accounts with no individual accountability. Devices running firmware nobody has looked at in years. None of these is exotic, and each one is covered by an item above, so they make a good first pass if you cannot do everything at once.
Quick check
Which protocol versions does the guide name?
TLS 1.3, SSH version 2 with strong key sizes, and SNMPv3 with encryption and authentication.
Why track end of life hardware?
Unsupported equipment stops receiving patches, and the guide asks defenders to track it and patch promptly.
Sources
Last reviewed: 19 October 2026.
