The NCSC’s warning that Russia’s FSB Centre 16 is scanning for vulnerable routers, including devices using weak or default management credentials, highlights how everyday network-management gaps can become a national security risk.
Many organisations have strengthened endpoint, identity and cloud security but the routers and switches connecting those controls can remain in service for years with outdated firmware, legacy protocols or unclear ownership. Attackers do not always need a highly sophisticated exploit when a neglected network device provides a practical foothold.
Closing that gap starts with visibility. Organisations need an accurate inventory of network devices, including ownership, software versions and support status. Default credentials should be removed, legacy SNMP versions disabled in favour of SNMPv3 and management access restricted to trusted networks.
Monitoring is equally important. Unexpected configuration changes, unusual login attempts and new connections between systems can all point to compromise. These signals should be considered alongside endpoint, identity and firewall data, giving security the context needed to distinguish activity from an attack.
Routine maintenance can no longer be treated as a purely operational task. Network firmware and management interfaces need the same disciplined patching, monitoring and lifecycle planning as other critical systems. Where equipment cannot be secured or upgraded, it should be isolated and replaced.
Consistently applying these controls reduces the routes available to state-backed actors and limited their ability to gain a foothold or move across systems. For critical sectors, network hygiene is part of national resilience.
Kevin Landt is Vice President of Product, Cybersecurity, Thrive
Be First to Comment