Why should unused services be disabled on network devices?

To preserve system resources and reduce the attack surface — unused services are openings threat actors can exploit.

Cisco routers and switches start with a list of active services that may not be required.

Disabling unused services:

• Preserves system resources (CPU cycles and RAM)
• Prevents threat actors from exploiting these services
• Reduces the attack surface

Commands to check open ports:

• IOS-XE: show ip ports all
• Older IOS: show control-plane host open-ports

IOS-XE typically has only HTTPS and DHCP ports open by default.

Go deeper:

• Hardening (computing) — Wikipedia — disabling unnecessary services is a core hardening step because each open service is a potential entry point.