Edge Device Security Guide

The firewalls, routers, load balancers, remote access gateways and file transfer appliances at the edge of the network are now the most reliable way into it, because they face the internet, hold privileged credentials and give defenders almost no visibility. The Five Eyes agencies published a joint series on edge devices in February 2025, and in February 2026 CISA ordered US federal agencies to retire end-of-support edge devices. This guide treats edge devices as one class: why they are targeted, what national guidance asks for, management plane and credential control, logging minimums and replacement planning. It is for network, infrastructure, security operations and procurement teams; VPN response, firewall rules and ZTNA design have their own linked guides.

Key takeaways

• Treat every edge device as an internet-facing application. ATT&CK T1190 (Exploit Public-Facing Application) explicitly covers "edge network infrastructure and related appliances", and the vendor web portal is usually the weakest part.
• The management plane must never face the internet. CISA BOD 23-02 gives 14 days to move management interfaces onto an isolated network or behind a separate zero trust policy enforcement point.
• Appliances are identity stores. Local admin accounts, bind accounts, RADIUS and TACACS+ secrets, SNMP strings, API tokens and private keys must be inventoried and rotated after any compromise.
• Buy forensic visibility, do not hope for it. Use the NCSC minimum for logging, configuration digests and volatile data capture as a procurement requirement.
• End of support means end of service. The ACSC recommends replacing end-of-life edge devices "immediately", and BOD 26-02 gives federal agencies 12 to 18 months to decommission them.

What counts as an edge device and why the class is targeted

The Canadian Centre for Cyber Security defines edge devices as "network hardware or software components that bridge internally managed networks" and external networks, and notes that they "are usually connected to the Internet and have public IP addresses". The February 2026 CISA, FBI and NCSC joint alert on end-of-support devices uses a broader definition: technology on the boundary of an organisation's network that can be reached from the internet or other external environments. In practice the class includes the device types below.

The devices run closed operating systems without endpoint agents, hold credentials that open the internal network and are reachable by anyone scanning the internet. The Cyber Centre states that "Targeting edge devices has now become a tactic of choice for many cyber threat actors, including state-sponsored actors." Cisco Talos, describing the ArcaneDoor campaign against Cisco ASA firewalls in April 2024, put it more bluntly: "perimeter network devices are the perfect intrusion point for espionage-focused campaigns." Talos reported a memory-only implant that could disable syslog and export the configuration, plus a component that survived reboots and upgrades.

What the Five Eyes and CISA guidance asks for

Push these into contracts: the ACSC asks buyers to "explicitly demand product security as part of the procurement process" and to verify firmware integrity on delivery.

Inventory, exposure and the management plane

The ACSC opens with "Knowing where edge devices exist is the first step to securing them." The CISA, FBI and NCSC joint alert adds: "Actively scan networks for undocumented and outdated edge devices." Combine CMDB records, external scans of your IP ranges and cloud images, and internal discovery, and record model, version, support end date, owner, exposed services and stored credentials. See the Attack Surface Management Guide.

• Management interfaces: BOD 23-02 covers "routers, switches, firewalls, VPN concentrators, proxies, load balancers," and "out of band server management interfaces (such as iLo and iDRAC)" reachable from the internet over HTTP(S), FTP, SNMP, Telnet, TFTP, RDP, rlogin, RSH, SSH, SMB, VNC or X11. Agencies must act within 14 days, either by limiting the interface to an internal network (CISA recommends an isolated management network) or, preferred, by placing a zero trust policy enforcement point that is separate from the interface in front of it.
• Out-of-band management: the Cyber Centre recommends "an out-of-band management network or administrative workstation" physically separate from production traffic, with administration done from dedicated hardened workstations. Use a dedicated interface or VRF and allow only privileged access workstations.
• Unused features: disable portals, clientless access, legacy services, unused IP versions and APIs. If SNMP is needed, the ACSC says "configure SNMPv3, allow it from only approved endpoints." Disable Telnet, HTTP management, TFTP and services such as Cisco Smart Install (TCP 4786) that ATT&CK lists as a route to configuration theft. See the Network Ports and Protocols Security Guide.
• SOHO and branch routers: CISA's Secure by Design alert describes Volt Typhoon and others using compromised SOHO routers as "launching pads" against critical infrastructure. Keep consumer-grade routers out of business sites and never trust the home router.

Hardening and configuration control

• Baseline before deployment: apply vendor and CIS hardening guidance and change defaults before go-live (ACSC, Cyber Centre), and keep the approved baseline in version control to measure drift.
• Two-person change review: the Cyber Centre recommends two or more reviewers for security configuration changes. Apply it to ACLs, management access, logging targets and AAA, the changes an intruder makes.
• Configuration secrets: configuration files are a primary target. ATT&CK T1602.002 (Network Device Configuration Dump) describes adversaries pulling configurations, including credentials, through SNMP and Smart Install. Use strong local password hashing (Cisco IOS type 8 or 9, not reversible type 7) and treat every configuration backup as a secret.
• Firmware and image integrity: ATT&CK T1601 (Modify System Image, with Patch System Image and Downgrade System Image) lists boot integrity (M1046) and code signing (M1045) as mitigations. Enable secure boot and image signature verification where supported, check vendor-published hashes before every upgrade, and alert on unexpected image changes or downgrades. See the Firmware and Boot Security Guide.
• Cryptography and rules: disable legacy TLS and SSH algorithms on management and data planes. IPsec proposals are covered in the VPN Security Guide and rule review in the Firewall Management Guide.

Where identity fits

Appliances hold many non-human identities, and edge compromises routinely end in credential theft.

• Separate edge administration from the corporate directory: the ACSC says "it is critical to segregate edge devices from an organisation's corporate AD forest". The Cyber Centre adds centralised, role-based authentication that is still segregated; a separate TACACS+ or RADIUS service with its own MFA meets both.
• AAA and command accounting: use TACACS+ (TCP 49) for per-command authorisation and accounting on routers and firewalls so every CLI command is attributed to a named person. Phishing-resistant MFA is the Cyber Centre's standard "for all administrative access to devices".
• Local and break-glass accounts: keep one local emergency account per device, unique per device, held in a PAM vault or secrets manager with rotation, which the ACSC recommends for local accounts. ATT&CK T1556.004 (Network Device Authentication) describes implants that patch the image to accept a hard-coded password, so a local account login you cannot match to a vault checkout is an incident. See the Break-Glass Account Guide.
• Service accounts and shared secrets: LDAP bind accounts, RADIUS and TACACS+ shared secrets, SNMPv3 users, SIEM and orchestration API tokens, and certificate private keys all live on the device. Inventory them per device so they can be rotated in hours. The Salt Typhoon Telecom Intrusions 2025 page shows how network device secrets kept intruders inside telecom networks for years. See the Service Account Security Guide.
• Appliance cloud roles: virtual appliances in cloud environments run with an instance role. The Capital One Breach 2019 began with a firewall's cloud role credentials; scope those roles to what the appliance needs.

Logging and forensic visibility minimums

The NCSC specification sets a "minimum requirement for forensic visibility". Use it as a procurement checklist and switch on everything current devices already support.

• Transport and time: near real time remote logging over TLS (syslog over TLS uses TCP 6514) in documented formats, a warning when remote logging is disabled, ISO 8601 UTC timestamps with milliseconds and alerts on NTP failure.
• Logs leave the box: the ACSC says edge devices should not be able to modify or delete their own logs. ArcaneDoor showed why: Talos recommended treating logging gaps and unexpected reboots as suspicious. See the Log Management and Retention Guide.
• Volatile data: the NCSC asks for authenticated collection of processes, memory, connections, sessions and core dumps. Know the vendor procedure before an incident; Talos advised following Cisco's forensic procedure without rebooting or taking a core dump first. See the Digital Forensics (DFIR) Guide.

Patching, integrity checks and compromise assessment

The ACSC is direct: "Applying a patch will not remedy a device that has already been compromised." It recommends scanning internet-facing devices "at least daily" and hunting for indicators of compromise before and after patching; the Cyber Centre adds testing patches on a standby device first. For an exploited flaw on any edge device, the sequence is the same: apply the vendor workaround the same day, preserve logs and volatile data, check integrity (vendor tools, configuration digest, image hashes), patch or rebuild from known-good media, then rotate every secret the device held and terminate active sessions. The CitrixBleed 2023 page shows stolen session tokens outliving the patch. The full runbook is in the VPN Security Guide, triage in the Zero-Day and Exploited Vulnerabilities Guide and routine cadence in the Patch Management Guide.

End of life and the replacement roadmap

The joint alert defines end-of-support devices as those whose manufacturer no longer monitors for defects or releases patches, and says to "Take prompt action to replace EOS edge devices." BOD 26-02, as reported when it was issued, sets the federal timeline below; CISA, the FBI and the NCSC encourage other organisations to follow it.

Where a device cannot yet be removed, the Cyber Centre asks for compensating controls. In practice: restrict it to known peers, remove management exposure and set a retirement date.

Choosing what replaces it

• Supported appliance: lowest change risk where the function must stay on premises (site-to-site, OT boundaries, data centre load balancing). Score vendors on patch track record and the NCSC logging minimums.
• Cloud-delivered service: moves the internet-facing surface and patching to a provider, at the cost of provider dependency. Suits remote access and web security for distributed staff.
• No listening portal: per-application access through outbound-only connectors. See the ZTNA Guide.
• Size matters: small organisations do better with fewer managed devices on automatic updates; large ones need a lifecycle register, a standard device per site type and a rolling replacement budget.

Implementation roadmap

1. Weeks 1 to 2, discover: scan external ranges, reconcile with the CMDB, record versions, support dates and exposed management services.
2. Weeks 2 to 4, close the management plane: move management interfaces to an isolated network or behind a policy enforcement point. Test from outside after each change; if administrators lose access, restore the previous ACL from version control through the management network.
3. Month 2, logging: forward edge logs over TLS to the SIEM, enable heartbeats or configuration polling, and alert on configuration export, logging changes, local account use and reboots.
4. Months 2 to 3, identity: move admin authentication to segregated AAA with MFA, vault local accounts, rotate device-held secrets.
5. Month 3, baselines: apply hardening to a standby or pilot device first, then roll out by site, keeping the previous configuration and current signed image for rollback.
6. Ongoing, lifecycle: fund replacement for every device ending support within 12 months and add the NCSC minimums to procurement templates.

Detection and measurement

Metrics that show the programme is working:

• Edge devices with management interfaces reachable from the internet (target: zero).
• Median and worst-case time from an exploited-vulnerability advisory to mitigation on edge devices, in hours.
• Percentage of edge devices sending logs and heartbeats to the SIEM, with gaps over one hour alerted.
• End-of-support edge devices in service, plus those ending support within 12 months without funded replacement.
• Percentage of edge devices whose running configuration digest matches the approved baseline.
• Percentage of admin access through central AAA with MFA, and local account logons per quarter.

Common failure patterns

• Patch and walk away: treating the upgrade as the fix when persistence survives it, as Talos reported for the ArcaneDoor component that survived reboots and upgrades. The Ivanti Connect Secure Exploitation 2024 page shows what an appliance compromise exposes beyond the box.
• Rebooting first: wiping the memory-resident evidence an assessment needs.
• Edge admins in the corporate directory: one stolen domain credential opens the perimeter, and the reverse.
• Secrets and sessions left valid: rebuilding the device but not rotating RADIUS secrets, bind accounts and keys, or not killing sessions. The CitrixBleed 2 (CVE-2025-5777) page shows a load balancer leaking live session tokens.
• Logs only on the box: the first thing an implant disables.
• Forgotten devices: lab units and branch routers missing from the patch report.

Framework mapping

Practitioner checklist

• Maintain one edge inventory with model, version, support end date, owner, exposed services and stored secrets, reconciled against external scans.
• Confirm no management interface is reachable from the internet, and recheck after every change.
• Run vulnerability scans against internet-facing edge devices at least daily.
• Authenticate administrators through a segregated AAA service with phishing-resistant MFA and per-command accounting.
• Vault one unique local emergency account per device and alert on any other local logon.
• Forward logs over TLS to the SIEM, alert on configuration export, logging changes, reboots and heartbeat gaps.
• Verify image hashes and configuration digests against approved baselines on a schedule.
• Hunt before and after every emergency patch, preserve evidence before rebooting and rotate device-held secrets.
• Fund replacement of every edge device reaching end of support within 12 months.
• Write the NCSC forensic visibility minimums into procurement requirements.

Standards and references

• NCSC: Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances
• ASD's ACSC: Mitigation strategies for edge devices, practitioner guidance
• Canadian Centre for Cyber Security: Security considerations for edge devices (ITSM.80.101)
• CISA: BOD 23-02 Mitigating the Risk from Internet-Exposed Management Interfaces
• CISA, FBI and NCSC: Reducing the Attack Surface for End-of-Support Edge Devices
• CISA: Secure by Design Alert, Security Design Improvements for SOHO Device Manufacturers
• MITRE ATT&CK: T1601 Modify System Image
• Cisco Talos: ArcaneDoor, new espionage-focused campaign found targeting perimeter network devices

Related NHI Mgmt Group resources: VPN Security Guide · Firewall Management Guide · ZTNA Guide · Attack Surface Management Guide · Privileged Access Management Guide