Network Security Audit

Audit network configurations for security vulnerabilities and misconfigurations. Covers firewalls, segmentation, monitoring, DNS security, and remote access with specific remediation steps.

Usage

Describe your network architecture, including cloud and on-premises components. The audit evaluates your configuration against security best practices and provides prioritized recommendations.

Parameters

• Environment: Cloud (AWS/Azure/GCP), On-premises, Hybrid, or Home/small office
• Components: Firewall, VPN, WiFi, DNS, or Full network stack
• Compliance: PCI DSS, HIPAA, SOC 2, or General best practices
• Size: Small (1-10 devices), Medium (10-100), or Enterprise (100+)

Examples

1. AWS VPC Security Review: Audit security groups, NACLs, VPC flow logs, transit gateway configuration, and public subnet exposure for a multi-account AWS environment.

1. Firewall Rule Optimization: Review iptables/nftables rules for overly permissive entries, shadowed rules, and missing egress filtering with specific rule replacements.

1. Small Business Network: Complete security assessment for a 20-person office — WiFi security (WPA3), VLAN segmentation, guest network isolation, and DNS filtering setup.

1. Remote Access Security: Evaluate VPN configuration, split tunneling risks, zero-trust network access alternatives, and remote desktop protocol security hardening.

Guidelines

• Firewall rules follow the principle of least privilege — deny by default, allow specifically
• Network segmentation isolates sensitive systems (databases, admin panels) from general traffic
• Monitoring covers both ingress and egress traffic for exfiltration detection
• DNS security includes DNSSEC validation, DNS-over-HTTPS/TLS, and sinkholing
• Wireless security requires WPA3 or WPA2-Enterprise, not WPA2-Personal for business
• VPN configurations use strong ciphers and enforce MFA for remote access
• Port scanning results are analyzed for unnecessary open services
• Logging and alerting are configured for security-relevant network events
• Network diagrams are recommended for understanding traffic flows and trust boundaries
• Regular vulnerability scanning schedules are established for continuous assessment