Many forms of security threats have emerged because of the rapid growth of the internet. Viruses, Trojan horse attacks, malicious hackers, and even the employees of an organization are potential security hazards to corporate networks. Such threats have the potential to steal and destroy sensitive corporate data, tie up valuable resources, and inflict major damage due to network downtime, which might lead to a financial crisis within the company. Security breaches are also encountered more frequently in home or private networks. Everyone has a reason to be concerned.
由於網際網路的快速成長，各種形式的安全威脅隨之出現。病毒、木馬程式攻擊、惡意駭客，甚至組織內部的員工，都可能成為企業網路的潛在安全隱患。這類威脅可能竊取並破壞敏感的企業資料、佔用寶貴的資源，並因網路停機而造成重大損害，進而可能導致公司陷入財務危機。安全漏洞在家用或私人網路中也越來越常見。每個人都有理由對此感到擔憂。
Common threats to network device security, and mitigation strategies, can be summarized as follows:
常見的網路裝置安全性威脅及其緩解策略，可歸納如下：
- Remote access threats: Unauthorized remote access is a threat when security is weak in remote access configuration. Mitigation techniques for this type of threat include configuring strong authentication and encryption for remote access policy and rules, configuration of login banners, use of ACLs, and virtual private network (VPN) access.遠端存取威脅：當遠端存取設定的安全性薄弱時，未經授權的遠端存取即成為威脅。此類威脅的緩解技術包括為遠端存取政策與規則設定強式驗證與加密、設定登入橫幅、使用 ACL，以及使用虛擬私人網路（VPN）存取。
- Local access and physical threats: These threats include physical damage to network device hardware, password recovery that is allowed by weak physical security policies, and device theft. Mitigation techniques for this type of threat include locking the wiring closet and allowing access only to authorized personnel. It also includes blocking physical access through a dropped ceiling, raised floor, window, duct work, or other possible points of entry. Use electronic access control and log all entry attempts. Monitor facilities with security cameras.本地存取與實體威脅：此類威脅包括網路裝置硬體的實體損壞、因薄弱的實體安全政策而允許的密碼復原，以及裝置遭竊。此類威脅的緩解技術包括鎖住配線間，並僅允許授權人員進入。也包括阻擋透過天花板夾層、高架地板、窗戶、風管或其他可能入口點的實體存取。使用電子存取控制並記錄所有進入嘗試。以監視攝影機監控設施。
- Environmental threats: Extreme temperature (heat or cold) or humidity extremes (too wet or too dry) can present a threat. Mitigation techniques for this type of threat include creating the proper operating environment through temperature control, humidity control, positive air flow, remote environmental alarms, and recording and monitoring.環境威脅：極端溫度（過熱或過冷）或濕度極端（過濕或過乾）都可能構成威脅。此類威脅的緩解技術包括透過溫度控制、濕度控制、正壓氣流、遠端環境警報，以及記錄與監控，來建立適當的運作環境。
- Electrical threats: Voltage spikes, insufficient supply voltage (brownouts), unconditioned power (noise), and total power loss are potential electrical threats. Mitigation techniques for this type of threat include limiting potential electrical supply problems by installing uninterruptible power supply (UPS) systems and generator sets, following a preventative maintenance plan, installing redundant power supplies, and using remote alarms and monitoring.電力威脅：電壓突波、供電不足（電壓驟降）、未調節電力（雜訊），以及完全斷電，都是潛在的電力威脅。此類威脅的緩解技術包括安裝不斷電系統（UPS）與發電機組以限制潛在電力供應問題、遵循預防性維護計畫、安裝備援電源供應器，以及使用遠端警報與監控。
- Maintenance threats: These threats include improper handling of important electronic components, lack of critical spare parts, poor cabling, and inadequate labeling. Mitigation techniques for this type of threat include using neat cable runs, labeling critical cables and components, stocking critical spares, and controlling access to console ports.維護威脅：此類威脅包括不當處理重要電子元件、缺乏關鍵備用零件、佈線不佳，以及標示不足。此類威脅的緩解技術包括使用整齊的纜線佈線、標示關鍵纜線與元件、儲備關鍵備用零件，以及控制主控台連接埠的存取。
Remote and local device access risks can also be mitigated with correct password policies. Even if potential intruders gain access to the device’s network or physical access to it, there is still a password needed before its configuration can be viewed or altered.
遠端與本地裝置存取的風險，也可以透過正確的密碼政策來緩解。即使潛在入侵者取得裝置的網路存取權，或取得對裝置的實體存取，仍然需要密碼才能檢視或變更其設定。
Password attacks are common. The three main methods of obtaining user passwords are as follows:
密碼攻擊很常見。取得使用者密碼的三種主要方法如下：
- Guessing: The attacker enters the passwords either manually or using a tool to automate the process.猜測：攻擊者手動輸入密碼，或使用工具自動化此過程。
- Brute force: Computer programs called "password crackers" perform the attack by systematically entering all possible passwords until it succeeds.暴力破解：稱為「密碼破解程式」的電腦程式透過系統化嘗試所有可能的密碼直到成功為止來執行攻擊。
- Dictionary attacks: This method is similar to brute force, but it uses word lists containing millions of words to create passwords to log in instead of random characters in sequences.字典攻擊：此方法與暴力破解類似，但它使用包含數百萬個單字的字詞清單來產生密碼進行登入，而不是隨機字元序列。
A password attack can be either an online attack or an offline attack. In an online attack, an attacker makes repeated attempts to log in. The activity is visible to the authentication system, so the system can automatically lock the account after too many bad guesses. Account lockout disables the account and makes it unavailable for further attacks during the lockout period. The lockout period and the number of allowed login attempts are configurable by a system administrator.
密碼攻擊可以是線上攻擊或離線攻擊。在線上攻擊中，攻擊者反覆嘗試登入。此活動對驗證系統是可見的，因此系統可以在錯誤猜測次數過多後自動鎖定帳號。帳號鎖定會停用該帳號，並使其在鎖定期間內無法用於進一步的攻擊。鎖定期間與允許的登入嘗試次數，均可由系統管理員設定。
Offline attacks are far more dangerous. In an online attack, the password has the protection of the system in which it is stored, but there is no such protection in offline attacks. In an offline attack, the attacker captures the password hash or the encrypted form of the password. The attacker can then make countless attempts to crack the password without being noticed.
離線攻擊危險得多。在線上攻擊中，密碼受到其儲存所在系統的保護，但離線攻擊沒有這種保護。在離線攻擊中，攻擊者會擷取密碼雜湊或密碼的加密形式，接著可以在不被察覺的情況下，進行無數次破解密碼的嘗試。
Longer and more complex passwords are time-consuming for the attackers to crack them. Specifying a minimum length of a password and forcing an enlarged character set (upper case, lower case, numeric, and special characters) can have an enormous influence on the feasibility of brute force attacks. However, if users attempt to meet the enlarged character set requirements by making simple adjustments, such as capitalizing the first letter and appending a number and an exclamation point (changing, for example, unicorn to Unicorn1!), little is gained against a dictionary attack using some simple transforms.
更長、更複雜的密碼會使攻擊者破解耗費更多時間。指定密碼的最小長度並強制使用更大的字元集（大寫、小寫、數字與特殊字元），能對暴力破解攻擊的可行性產生極大的影響。然而，如果使用者試圖以簡單的調整來滿足擴大字元集的要求，例如將第一個字母大寫並在結尾加上一個數字與一個驚嘆號（例如將 unicorn 改為 Unicorn1!），那麼在使用一些簡單轉換的字典攻擊面前，幾乎沒有增加多少防護力。
Besides the password creation, password policy consists of password management, which includes storage, protection, and password changes. In an enterprise environment, password management should follow these guidelines:
除了密碼建立之外，密碼政策還包含密碼管理，其中包括儲存、保護與密碼變更。在企業環境中，密碼管理應遵循以下準則：
- Storing, transmitting, or copying passwords in cleartext should not be possible.不應以明文儲存、傳輸或複製密碼。
- Passwords should be stored in a centralized database, where each user uses their own credentials to access only the passwords they are authorized to access密碼應儲存在集中式資料庫中，每位使用者使用自己的憑證，僅能存取其獲授權存取的密碼。
- The access to passwords should be audited and a log kept with a timestamp, user and which password was accessed.應稽核密碼的存取，並保留記錄，包含時間戳記、使用者以及所存取的密碼。
- Creating, deleting, and editing passwords should follow company’s security guidelines.建立、刪除與編輯密碼應遵循公司的安全性準則。
- Passwords should be changed regularly, depending on the password complexity and company security policy, and old passwords should never be reused.應根據密碼複雜度與公司安全政策定期變更密碼，且絕不應重複使用舊密碼。
The combination of a username and a password to access a device in cases where a device is a high security risk might not be enough. Additional or alternative security measures can be introduced:
在裝置屬於高安全風險的情況下，僅使用使用者名稱與密碼來存取裝置可能不夠。可以導入額外或替代的安全性措施：
- Multi-factor authentication: In addition to the username and password, at least an extra step is required for authentication. The second factor can be in different forms, such as a push notification from a server (used on web and mobile applications), or a security token from either a hardware device, a piece of software, or a text message. One-Time-Password (OTP), where a security value is being used only once, is one of the most commonly used approaches for multi-factor authentication. An example of this is when a text message or email is sent to your mobile phone with the required additional information.多因素驗證：除了使用者名稱與密碼之外，還需要至少一個額外的驗證步驟。第二因素可以有不同的形式，例如來自伺服器的推播通知（用於網頁與行動應用程式），或來自硬體裝置、軟體，或簡訊的安全性權杖。一次性密碼（OTP）——一種僅使用一次的安全值——是多因素驗證中最常用的方法之一。例如，簡訊或電子郵件會傳送到你的手機，附帶所需的額外資訊。
- Digital certificate: A document, which in essence binds together the name of the entity and its public key, which has been signed by the certificate authority. The document ensures that the certificate holder is really who they say they are, and this information can be verified by the certificate authority. Certificates are commonly used on websites, where on initial connection with the server your computer verifies the server’s certificate with the certificate authority, to trust the server.數位憑證：一份文件，本質上將實體的名稱與其公開金鑰綁定在一起，並由憑證授權單位簽署。此文件確保憑證持有人確實是其所聲稱的身分，且此資訊可由憑證授權單位驗證。憑證常用於網站，在與伺服器建立初始連線時，你的電腦會向憑證授權單位驗證伺服器的憑證，以信任該伺服器。
- Biometrics: This technology is widely used in phones and personal computers. It offers ease of use, relatively high security compared to entering PIN numbers or passwords and is linked to an individual person, and therefore, it is hard to compromise. Biometric technologies include fingerprint, iris, voice, face, heart beat, and other types of recognitions. Many of them can be found in mobile devices, smartphones, and even in home door access control systems today. To increase the reliability and security, systems might use a combination of these technologies and traditional username and password credentials to authenticate users.生物識別：此技術廣泛用於手機與個人電腦。相較於輸入 PIN 碼或密碼，它使用方便、安全性相對較高，且與個人本身連結，因此難以被冒用。生物識別技術包括指紋、虹膜、聲音、臉部、心跳及其他辨識類型。如今許多行動裝置、智慧型手機，甚至家用門禁系統中都可以找到這些技術。為了提高可靠性與安全性，系統可能會結合這些技術與傳統的使用者名稱及密碼憑證來驗證使用者。