Product portfolio protection
NetCloud Manager security
Ericsson’s model combines purpose-built networking endpoints with centralized, cloud-based management. NetCloud Manager uses the cloud to manage network configurations, policies, monitoring, and operations without sending the customer data traversing Ericsson devices through the cloud service. This separation allows IT teams to gain the operational benefits of cloud management while retaining control of their data traffic. Securing NetCloud Manager and the network-management information it handles is therefore a critical part of the service.
Securing the back end
Ericsson’s cloud services are hosted within Amazon Web Services, which provides physical security, redundancy, and recovery capabilities such as externally audited data centers, continuous monitoring, multiple availability zones, and offsite backups.
Cloud services operate through a shared-responsibility model. Ericsson inherits infrastructure controls from AWS but remains responsible for the security of the solution.
NetCloud Manager is engineered for high availability across geographic zones with auto-scaling. Customer network-configuration data is protected through encryption at rest and in transit.
NetCloud Manager account security
Ericsson is responsible for the security of NetCloud as a whole, while customers are responsible for securing their NetCloud Manager access. Recommended configurable options include:
Force multi-factor authentication
Requires every user in the NetCloud Manager account to configure and sign in with an MFA application such as Okta, Google Authenticator, or another time-based one-time-password application.
Federated ID and single sign-on
Allows customers to use their directory environment, such as Active Directory, to authenticate NetCloud Manager users. This creates a more transparent login experience, reduces user-administration overhead, and allows internal security policies to be enforced.
Enhanced security login
For customers that do not use Federated ID, Enhanced Login Security supports user lockouts, automatic disabling of inactive users, password expiration, and password history.
Granular user permissions
Administrators can implement least privilege by restricting users according to role and subaccount and limiting access to authorized devices and groups.
Alerts
NetCloud Manager provides alerts at group and subaccount levels for events such as unauthorized configuration changes, failed device logins, and WAN-interface disconnections.
Secure transport of device configuration
Ericsson developed a secure stream protocol designed to be more efficient and scalable than SNMP, allowing devices to communicate securely with NetCloud Manager across multiple layers of network address translation.
The management stream is client initiated. Devices do not require a publicly routable address or externally facing open port to connect to NetCloud.
The connection is certificate based, providing device authentication, authorization, and accountability, and is encrypted using Transport Layer Security.
After a session is established, NetCloud Manager and the device exchange periodic keepalive packets for real-time, bidirectional communication. If a session drops, the endpoint attempts to reconnect across any available WAN interface.
Hardware security measures
NetCloud OS is the operating system on Ericsson Cradlepoint endpoints and enables centralized orchestration through NetCloud Manager. Several security measures are incorporated into the hardware before customer configuration.
Penetration testing
Ericsson Cradlepoint hardware and NetCloud OS are regularly tested to identify and remediate vulnerabilities.
Secure password storage
NetCloud OS user passwords are salted and hashed using strong, nonreversible encryption.
Secure-by-design default configuration
- Unique default passwords for every device
- Stateful, zone-based firewall with default denial of unsolicited inbound traffic
- Remote administration, GPS, and UPnP disabled by default
- Ban-IP Address enabled by default, temporarily blocking IP addresses after five failed NetCloud OS login attempts
Signed NetCloud OS upgrades
All NetCloud OS versions are signed by Ericsson Enterprise Wireless and verified by the device before installation. This prevents unauthorized, modified, or malicious installation of NetCloud OS or other software. Read our security best practices.