DISA Security Technical Implementation Guides (STIGs) SRG-6: SRG-6 NDM general requirements: out-of-band or leak-free management network, SNMPv3, logging to syslog, AAA, authenticated NTP, secure image and configuration storage

The NDM SRG's general requirements, condensed from the Network Management Security Guidance At-a-Glance: management traffic carried on an out-of-band management network whose interface forwards no transit traffic, or where no OOBM port exists a management interface configured so that management traffic does not leak into the managed network and production traffic not into the management network; in-band sessions over TCP with keepalives so an orphaned session is terminated; SNMPv3 with the user-based security model for authentication, privacy and access control; per-session and per-user logging of all configuration changes with logs sent to a centralised syslog server; centralised AAA over RADIUS, TACACS+ or Kerberos with group-based authorisation; communications servers for console access when the OOBM network is down; NTP servers connected only to the management network, with single points of failure eliminated and NTP authentication to defeat rogue time sources; the SNMP manager connected only to the management network; and device images and configurations stored off-line with prior and current versions retained and transferred by secure methods rather than FTP or TFTP.