SC – Hardened Network Assessment -

1

IT Governance

IT governance sets the foundation for an enterprise’s IT security posture. It requires an IT steering committee; IT policies, procedures, standards, and guidelines; and performance measures and metrics.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

1/1 IT Governance (Click Box If Yes)

Are IT policies, procedures, standards, and guidelines in place and followed?
Do employees receive end user security awareness testing and training?
Are IT policies based on a security controls framework?
Does the CISO report to the CIO?
Does an IT steering committee or equivalent exist?
Are annual compliance tests (e.g., SOX, PCI, and HIPAA) performed?

Next section Previous section

2

WAN/MAN

Wide area networks are primarily associated with organizations that have multiple remote physical locations requiring direct connections to the enterprise’s core network. This section focuses on security measure and controls surrounding WAN and MAN.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

1/1 Remote Organization Location (Click Box If Yes)

Do remote locations adhere to enterprise IT policies, procedures, standards, and guidelines?
Do remote locations have limited technology (e.g., firewalls, distribution switches, workstations, and multi-function printing)?

Next section Previous section

3

Internet

All organizations have an Internet presence, Internet access, and third-party connections, such as connections to cloud providers and strategic partners. This section focuses on the security and controls surrounding an organization’s Internet presence.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

4

ISP and Next-Generation Firewall

All organizations with Internet access have an Internet service provider (ISP) and a firewall to protect IT assets from bad actors on the Internet. This section provides important security measures and controls related to the ISP and the Internet-facing next-generation firewall.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

5

Web Application

Many organizations enable customers to interact with them via a web application. Securing web applications has become a critical component of securing an enterprises overall technology environment. This section provides basic controls for securing web applications.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

1/2 Web Application Firewall (Click Box If Yes)

Are web application-specific vulnerability assessments performed?
Is URL filtering enabled and configured?

2/2 Web Applications— User Provisioning: (Click Box If Yes)

Are administrator accounts managed?
Are user accounts managed?
Are user accounts configured with role-based security and least access principles?
Does the enterprise practice security-conscious development?
Are inactive accounts disabled?

Next section Previous section

6

Core Router and WiFi

In this section of the questionnaire, we begin to evaluate the security posture of the internal network. This starts with ensuring that the core of the network is secure. A properly configured core network router/switch is the starting point of a secure internal computing environment.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

7

Active Directory

Typically, a network has a directory service technology, such as Active Directory, and a network access control (NAC) solution. In addition, there is an access layer switch, with defined user VLANs. This section provides important security measure and controls related to Active Directory, NAC, and access-layer switching.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

8

Server Farm vLAN

The final section of this high-level hardened enterprise network assessment focuses on enterprise applications and network storage. Effective data security is one of an enterprise’s most valuable assets. These questions provide insight into how the enterprise protects its data.

MUST-HAVE ITEMS

MODERATELY SECURITY-FOCUSED

EXTREMELY SECURITY-FOCUSED

Hardened Network Security Assessment

ASSESSMENT COMPLETED!