Network Security Audit

Network Security Audit

Photo by Brett Sayles on Pexels

Your network is the backbone of your IT infrastructure. Every device, every connection, and every piece of data flows through it. A network security audit identifies vulnerabilities that could let attackers move laterally through your systems or steal sensitive information.

Firewall Configuration Audit

Your firewall is the first line of defense between your internal network and the internet. Audit these critical settings:

• Firmware updates — Is the firewall firmware current? Check the manufacturer's website for the latest version.
• Default passwords changed — Never leave factory credentials on any network device. This is how many routers get compromised.
• Rule review — Are there unused or overly broad firewall rules? Remove any "allow all" rules.
• Inbound ports — Only open ports that are absolutely needed. RDP (port 3389) should never be directly exposed to the internet.
• Logging enabled — Is traffic logging active? You need logs to investigate incidents.
• Geo-blocking — Block traffic from countries where you have no business activity.

Wi-Fi Security Audit

Wireless networks are a common entry point. Check the following:

• Encryption — Use WPA2-AES or WPA3. Never use WEP or WPA-TKIP — they are crackable in minutes.
• Network segmentation — Is there a separate guest Wi-Fi network? Guests should never access the business network.
• Strong Wi-Fi password — At least 16 characters, changed annually or when staff changes.
• SSID broadcasting — Consider hiding the business network SSID for added obscurity.
• WPS disabled — Wi-Fi Protected Setup has known vulnerabilities. Disable it.
• Guest network isolation — Can guest network devices see each other? Enable AP isolation to prevent this.

Step-by-Step Network Audit Process

1. Map your network — Draw a diagram showing all devices, connections, and IP ranges
2. Scan for devices — Use Nmap or Advanced IP Scanner to find all connected devices
3. Identify unknowns — Any device you cannot identify should be investigated immediately
4. Check firewall rules — Review all inbound and outbound rules for necessity
5. Test Wi-Fi security — Verify encryption and attempt to connect to guest network
6. Verify VPN — If using a VPN, test configuration and verify encryption protocols
7. Check for rogue access points — Scan for unauthorized Wi-Fi devices connected to your network
8. Review DNS settings — Use a filtered DNS service like Cisco Umbrella or Cloudflare 1.1.1.2 for malware blocking

VPN and Remote Access Audit

Remote access has become essential. Verify these security controls:

• VPN uses strong encryption (AES-256 minimum)
• MFA is required for VPN connections
• Remote Desktop Protocol (RDP) is never exposed directly to the internet — always behind a VPN
• Session timeouts are configured (disconnect after 15-30 minutes of inactivity)
• VPN logs are retained for at least 90 days
• Split tunneling is evaluated — disabling it forces all traffic through the secure VPN

Network Monitoring and Alerting

You cannot protect what you cannot see. Set up basic monitoring:

• Bandwidth monitoring — Track normal vs abnormal traffic patterns
• New device alerts — Get notified when an unknown device joins the network
• Port scan detection — Alert on port scanning attempts from external sources
• Firewall log review — Review logs weekly for unusual activity

Free Network Audit Tools

• Nmap — Free network scanner for discovering devices and open ports
• Wireshark — Free network protocol analyzer for traffic inspection
• Advanced IP Scanner — Free tool for scanning networked devices
• OpenVAS (Greenbone) — Free open-source vulnerability scanner
• Angry IP Scanner — Free lightweight network scanner
• Cloudflare 1.1.1.1 for Families — Free filtered DNS for malware blocking

Key Takeaways

• Review firewall rules and firmware regularly — defaults are insecure
• Segment guest and business Wi-Fi networks — never allow cross-traffic
• Never expose RDP directly to the internet — always use a VPN
• Scan your network regularly to detect unknown devices
• Enable logging and monitoring — you need visibility to respond to threats