SNMP (Simple Network Management Protocol)
PCIComplianceHubLast updated
The protocol network devices use to report status and accept configuration from a management system. Its early versions send their community strings, the passwords in effect, in the clear, and ship with defaults such as 'public' and 'private' that PCI DSS requires to be changed.
Applies to. Every network device and system in scope that speaks it, and wireless environments in particular.
Example. A wireless access point still answers to the community string it shipped with. 2.3.1 names SNMP defaults among the wireless vendor defaults that must be changed at installation, and 2.2.2 does the same for default accounts on any system component.
Limits. Versions 1 and 2c are insecure services in the standard's terms: if they are present, 2.2.5 requires a documented business justification and additional security features, and 1.2.6 requires the risk to be mitigated. Version 3 with authentication and privacy is the usual answer. Management traffic that can reconfigure a network security control is administrative access and must be encrypted under 2.2.7.