Vendor defaults that will hurt you

Every network device ships configured to work with minimal effort. That is a reasonable commercial decision and a poor security posture, and the gap between the two is a predictable source of incidents.

Management on everything

Devices often listen for management on every interface by default, including the one facing the internet. Restrict management to a specific interface or source range as the first act of configuration, before the device is reachable from anywhere it should not be.

Protocols you did not ask for

Discovery protocols advertise your device’s model, software version and port to whatever is plugged in. Useful internally, a gift to anyone else. Small web servers, TFTP servers and legacy remote access services are frequently enabled by default on platforms that have not been audited in years.

show ip sockets
show control-plane host open-ports
ss -lntup            # on Linux-based platforms

Run one of those on a device you did not configure yourself. The result is usually surprising.

Credentials

Default accounts, default community strings, and — worse — a single credential shared across every device because it was convenient during the rollout. The last of these is the one that turns a single compromise into a whole-estate compromise.

Unused ports

An unused switch port in the default VLAN is an unauthenticated network connection in a corridor. Shut unused ports and place them in an unused VLAN. Both, not either.

Logging

Default logging is usually a small local buffer that wraps within hours and is lost entirely on reboot. When you need to understand an incident, the evidence has already gone. Send logs somewhere else and keep them long enough to be useful.

The practical approach

Write a hardening baseline once, as a checklist, and apply it to every device before it carries traffic. Not a document to read, a list to execute. The value is in it being applied identically every time, including at the end of a long day when the device “just needs to be in quickly”.