NETWORK ARCHITECTURE REVIEW: Examine the routes into your most important systems.
A network architecture review examines how connections, segmentation and administrative access affect the routes into important systems. Subdux reviews traffic paths and dependencies, then identifies design changes that restrict unnecessary access while accounting for the business services, availability and recovery arrangements the network needs to support.
- Discipline
- Managed Security & Advisory
- Engagement type
- Assessment
The diagram may show separation. The connections need to support it.
Networks develop around projects, acquisitions, temporary access and operational exceptions. A guest segment may still reach internal services. A management interface may be available from an ordinary workstation. A supplier connection may have outlasted its original purpose. We examine how the design behaves against the access boundaries your organisation intends to maintain.
Useful starting points
A cloud migration or new site has changed how systems connect.
Your network has grown through exceptions that are difficult to explain or review.
You want to understand how far an intruder could move after gaining an initial foothold.
Follow the paths between users, systems and administration.
Segmentation and trust boundaries
Review separation between user devices, servers, guests, management systems and sensitive workloads, including rules that reconnect otherwise separate zones.
Entry and exit routes
Examine public services, remote access, outbound permissions and the paths used by third parties.
Administrative access
Assess how administrators reach infrastructure, where management services are exposed and whether everyday access provides unnecessary reach.
Cloud and hybrid connections
Review routing, security controls and dependencies across on-premises networks, cloud environments and connected services.
Visibility and continuity
Check whether important boundaries produce useful records and whether protective changes account for shared services, recovery and availability needs.
Base the changes on required connections.
We work through diagrams, relevant configurations and representative traffic information with the people who operate the environment. Where validation is included, we check selected paths against the intended rules. A recommended restriction needs to account for legitimate workflows, monitoring and recovery access before it becomes a change request.
What you receive
An annotated view of the reviewed zones, connections and assumptions.
Findings tied to specific access paths or design weaknesses.
Recommended changes, with dependencies and sequencing for rollout.
A review session with network and application owners; implementation and subsequent validation can be included in the work commissioned.
Is this a penetration test?
No. The review examines architecture and relevant configurations. A penetration test attempts to exploit weaknesses in an authorised scope. The two can complement each other when you need both a design assessment and technical validation of a potential attack path.
Do we need current network diagrams?
Existing diagrams help, but they are often incomplete. We establish what documentation and configuration information is available and whether updating the network view needs to form part of the engagement.
Can you help make the changes?
Yes. Design and implementation support can extend the review. Changes to routing, segmentation or remote access need suitable testing and rollback arrangements because they can affect operational dependencies.
Identify the connections that deserve a closer look.
Share the environment you want reviewed and the change or concern behind it. We can start with a selected network boundary or a wider architecture.
Related services: Cloud Security Testing and Identity & Access Management.