Quick answer: a network security assessment reviews firewall rules and configuration, network segmentation, VPN and remote-access setup, wireless security, and DNS configuration, and generally turns up outdated firewall rules, a flat unsegmented network, and remote-access services that are more exposed than the business realizes. Here’s what the assessment actually covers and what tends to surface.
Firewall rule review
Firewall rulesets accumulate over years, and it’s rare to find one that’s been cleaned up on any regular schedule. We look for overly permissive rules (“allow any/any” configurations left over from troubleshooting a problem years ago and never tightened back up), rules referencing systems that no longer exist, and rules nobody can explain the original reason for, which is usually a sign it’s safe to remove, but needs verifying first.
Network segmentation
A large share of the small business networks we assess are effectively flat: a guest laptop, a point-of-sale terminal, and the server holding financial records all sit on the same network segment, able to reach each other directly. Segmentation, separating guest traffic, IoT devices, and critical systems onto distinct network zones, means a single compromised device doesn’t automatically have a path to everything else. This is often one of the more involved fixes we recommend, but also one of the highest-impact ones for containing a future incident.
VPN and remote-access configuration
Beyond checking for directly exposed RDP or admin panels, we look at how existing VPNs are configured, split-tunneling settings that route more traffic outside the VPN than intended, weak or shared credentials on the VPN itself, and whether MFA is actually enforced on the connection or just available and unused. A VPN that’s technically in place but loosely configured provides less protection than it appears to on paper.
Wireless network security
We check whether guest wireless is genuinely isolated from the internal network (a surprisingly common gap), what encryption standard is in use, and whether the wireless password has ever been rotated since setup, often the answer is no, sometimes for years, across every employee and former employee who was ever given it.
DNS configuration
DNS is one of the most under-monitored parts of most networks’ infrastructure, and it’s where we sometimes find stale records pointing at decommissioned services, or a registrar account with weak security of its own, a compromised DNS registrar account can redirect traffic or email for an entire domain. Our DNS security write-up covers this in more depth.
What usually comes out of the assessment
Most assessments end with a prioritized list rather than a single dramatic finding: a handful of firewall rules to clean up, a segmentation project scoped in phases rather than all at once, and one or two remote-access items that need fixing immediately rather than on a roadmap. Our Network Security service covers the full review and the implementation work that follows it.