Network Infrastructure Security Baseline

A set of foundational security controls that must be in place on network infrastructure devices (router, switch, firewall): management plane isolation, centralized AAA, protocol hardening, segmentation and access control lists, syslog/NetFlow monitoring, and firmware integrity. The core framework is SANS CIS Controls v8 (Controls 12–13); concrete values are drawn from the NSA/CISA Network Infrastructure Security Guide, DISA STIG, and CIS device benchmarks.