Should our firewall or router admin page be reachable from the internet?

What is an admin login page?

Threat actors have used certain classes of network devices to gain unrestricted access to organizational networks leading to full scale compromises.

Routers, firewalls, VPN boxes and servers have a management page where settings are changed. It often sits at a host name such as admin, firewall or remote.

Why does it matter?

Most device management interfaces are designed to be accessed from dedicated physical interfaces and/or management networks and are not meant to be accessible directly from the public internet.

CISA issued Binding Operational Directive 23-02 on 13 June 2023 because attackers used network devices to gain unrestricted access to organizations' networks.

What does CISA require?

Within 14 days of notification by CISA or discovery by an agency of a networked management interface in scope for this Directive, agencies will take at least one of the following actions: Remove the interface from the internet by making it only accessible from an internal enterprise network

Within 14 days of finding one, US federal agencies must remove the interface from the internet or put it behind an access control that is separate from the interface itself. The directive binds only federal agencies, but the same rule suits a small firm.

What do I do about it?

1. Turn off remote management on the outside interface in your router or firewall settings.
2. Manage devices only from inside the office or through a VPN with multi-factor sign-in.
3. Change default admin passwords on every device.
4. Check from outside the office that the admin page no longer loads.