SNMP Security Assessment

This guide treats SNMP agents, managers, and trap receivers as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Inventory managed devices, managers, trap receivers, and approved source ranges.

2. 02

   Record SNMP versions and required object families.

3. 03

   Separate read-only monitoring from configuration workflows.

4. 04

   Identify credentials or keys stored in network-management platforms.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm SNMPv1 and v2c are absent or explicitly isolated.

2. 02

   Use an approved read-only identity to request a minimal standard object.

3. 03

   Verify write access is unavailable to monitoring identities.

4. 04

   Check that agents are unreachable outside management networks.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log authentication failures, write attempts, configuration changes, and new managers.
• Alert on requests from non-management zones.
• Protect inventory metadata and trap contents as sensitive operational data.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Prefer SNMPv3 with authentication and privacy.
• Restrict agents to management networks and known managers.
• Separate read and write identities.
• Rotate credentials and remove default community strings.