After reading, you can check a network against recognised controls and compare what is documented with what is really there.
Definition
It draws on recognised sources: ISO/IEC 27002 controls 8.20 to 8.22 on the security of networks, network services and segregation, and the CIS Controls on enterprise assets, secure configuration and network infrastructure management.
Why it matters
Networks collect old firewall rules, forgotten devices and vendor accounts over the years. An attacker who gets inside will use exactly those to move around.
How it works
Start by comparing the documented diagram and device inventory with a scan of what is really there. The difference is often the first finding.
Then review segmentation and firewall rules, administrator access and MFA, firmware versions, wireless and remote access, logging, and configuration backups.
Record the evidence on each line, rate the findings by risk, and plan the corrections with an owner and a date.
A worked case
A plant's inventory lists 84 devices, and the scan finds 91. Seven are unmanaged switches on the production floor. Of 412 firewall rules, 60 have gone unused for a year, and one lets the office network into the production network with no restriction.
That rule is rated high and comes out within a week. The review of unused rules follows within the quarter.
Good practices
- Scan only with written authorisation and in agreed time slots. A scan can upset fragile devices.
- Give every firewall rule an owner and a reason, so that the next review knows what can go.
- Require MFA for administrator and remote access.
- Back up device configurations and test restoring them.
Common mistakes
- Trusting a diagram nobody has updated since the last migration.
- Stopping at the firewall and forgetting wireless and vendor access.
- Listing weaknesses with no rating or owner, which leaves the network team with a report and no plan.
- Confusing a vulnerability scan with an audit. The scan is one input among several.
Questions
- How often should a network be audited?
- Usually once a year and after major changes, with automated scans in between.
- What tools does a network audit use?
- Discovery and vulnerability scanners, firewall rule analysers, and the devices' own configuration exports.
- Is a network audit a penetration test?
- No. The audit checks against criteria, and a penetration test tries to exploit weaknesses. They complement each other.
- What documents should be requested first?
- Network diagrams, the device inventory, firewall rule sets, the list of administrators and the latest change records.
- Which firewall rules are the most risky?
- Rules with any source, any destination or any service, rules without an owner, and old temporary rules still active.