I'm about to mount my soapbox and touch upon the "need" for something like SFTP for network device backups, targeting a couple of points made by @MHM Cisco World , but I'm not targeting MHM.
"Each day or one week, the network engineer need to keep backup of network device config . . "
Yup, not bad practice, although I like systems that pick up device config changes shortly after they've been made.
". . . these Config include sensitive info."
True, but just how sensitive?
"Like password public IP . . ."
Hopefully config passwords are not in clear text or an easily breakable encryption format.
How secret is a "public" IP?
Regarding man-in-the-middle, if we're discussing internal networks, are your employees vetted? Is access to network infrastructure devices behind locked doors/cabinets (i.e. can someone easily get in the middle of the network device and the config backup host)?
Again, how sensitive is the config? Huge difference, I believe, in seeing a device config and being able to access the device.
Don't misunderstand, I'm not against security, just in my experience, many security folk focus on security to protect against all possible threats regardless of cost to do so. For example, from a security standpoint, leaving under a dollar's worth of change in my unlocked desk drawer allows it to be easily stolen. That's true. But, conversely we probably don't need a ten ton safe, with time locks, and multiple person keys, to protect under a dollar of loose change.
In my experience, often is seems it's one extreme or the other, i.e. no one considers security threats at all or we need Fort Knox level of security for everything.
In the case MHM mentions, if I'm an attacker, and I really want to see multiple device configs, do I work at multiple man-in-the-middle attacks or do I work on breaching the security of the host containing all the backup config copies?
Again, I'm not arguing there's anything wrong in using SFTP for device config backups, and all else being equal, it's probably good to use host-to-host encryption, but it really needs to analyzed in the larger picture.
One issue that can be overlooked when using encryption, if data volume is a concern, generally it cannot be well compressed, unless compression is done before encryption (of course, a device config doesn't usually have the "volume" this would be an issue), but if a company is using SFTP willy-nilly, host to host, because it's more secure than FTP (true), it can preclude a network edge device doing both effective compression (e.g. WAFS, WAAS) with optional encryption.
Jim ( @Ramblin Tech ) mentions "Network operators with a CSO/CISO will most likely have a policy requiring login creds to be sent as cyphertext.", which is probably true in the larger network operators. Possibly not as true in smaller network operators.
Anyway, my soapbox point is, consider the big picture, benefits vs. costs, operational impacts, security failure impact.
Also realize, perfection is often a worthwhile goal, but often not obtainable, at least at an acceptable cost, so some risk is often acceptable.
