tacacs

TACACS+ is a network authentication protocol commonly used in enterprise and service-provider environments to control access to network devices like routers and switches. Discussions on WindowsForum highlight how TACACS+ can be abused by advanced persistent threats (APTs) when left unsecured. In particular, China-linked state actors have been observed exploiting TACACS+ alongside other protocols (such as RADIUS, SNMP, and embedded packet capture) to intercept authentication traffic and maintain persistent access on compromised core routers. The tag covers security hardening, configuration best practices, and mitigation strategies for TACACS+ deployments, especially in the context of defending against sophisticated network infrastructure attacks. It is relevant for network administrators and security professionals managing Cisco or other TACACS+-compatible devices.