Start with HTTPS management, then disable unused ports, enforce SSHv2, and enable RADIUS/AAA centralized auth.
Industry news
Industrial Switch Hardening Checklist
Eight practical steps from default-credential rotation to port mirroring and traffic anomaly alerts.