audit-network-security
Audit Network Security
Systematically assess network security controls to identify misconfigurations, unauthorized access paths, and compliance gaps before attackers do.
Why This Is Best Practice
Adopted by: PCI DSS requires quarterly external scans and annual penetration tests; SOC 2 requires periodic network security review; FedRAMP mandates continuous monitoring Impact: Proactive audits find 3x more vulnerabilities than reactive incident investigation (Verizon DBIR 2023); average dwell time before detection is 204 days — audits compress this to zero Why best: Network misconfigurations are the #2 cause of breaches (DBIR 2023); automated scanning cannot replace structured audit methodology that tests intent vs. implementation
Sources: NIST SP 800-115 (2008); CIS Controls v8 Control 12-13 (2021); PCI DSS v4.0 Requirement 11
Steps
-
Define audit scope — Specify IP ranges, cloud accounts, VPCs, and services in scope. Document what is explicitly out of scope and why. Obtain written authorization before scanning; unauthorized scans violate cloud provider ToS and may trigger security alerts.
-
Enumerate network topology — Collect: network diagrams, routing tables, firewall rule sets, security group configurations, NACL policies. Compare documented architecture to actual configuration — discrepancies are immediate findings.
-
Scan for open ports and services — Run nmap against in-scope hosts:
nmap -sV -sC -p- --open <target>. Identify services running on non-standard ports. Flag any management services (SSH port 22, RDP 3389, database ports) exposed to the internet.