Encryption transforms readable data into ciphertext that only a recipient with the appropriate decryption capability can restore. Cleartext is information that will not be encrypted; plaintext is information awaiting encryption; ciphertext is encrypted information. Encryption primarily protects confidentiality, especially when wireless signals can be received by nearby devices. section 20.1.1 section 18.1.1
Apply encryption with these distinctions:
- Separate confidentiality from integrity: encryption hides contents, but an attacker may still alter ciphertext through a bit-flipping attack. section 20.1.1
- Use an integrity mechanism such as a checksum alongside encryption; the receiver decrypts the message and calculates its own checksum for comparison. section 20.1.1
- Recognize protocol differences: SNMPv1 and SNMPv2c use community strings without encryption, while SNMPv3 adds encryption and improved authentication. section 6.3
- Avoid WEP for wireless security because its encryption and integrity measures have vulnerabilities; WPA, WPA2, and WPA3 replaced it. section 20.3
SNMPv3 AuthPriv configuration
R1(config)# snmp-server group GROUP1 v3 priv R1(config)# snmp-server user USER1 GROUP1 v3 auth sha AuthPW priv aes 256 PrivPW The group selects AuthPriv, which provides authentication and encryption. The user configuration assigns USER1 to GROUP1, uses SHA authentication, and selects AES-256 encryption. section 6.3.2
R1(config)# snmp-server group GROUP1 v3 priv #1 R1(config)# snmp-server user USER1 GROUP1 v3 auth sha AuthPW priv aes 256 PrivPW #2 #1 Creates a group with AuthPriv security #2 Creates a user account (USER1) in the GROUP 1 group
Use the annotated Cisco IOS listing to inspect how an SNMPv3 group and encrypted user are configured. section 6.3.2
