Firewall Configuration Review
Analyse firewall rules, ACLs, NAT policies, and traffic filtering to detect misconfiguration and security gaps.
Infrastructure Security
Firewall & Infrastructure Security
Securing your network perimeter and infrastructure is critical to preventing cyberattacks. At BlockSecBrain, our experts perform comprehensive firewall and core infrastructure assessments, including configuration reviews, vulnerability scanning, access control analysis, and compliance checks to ensure maximum protection for your systems.
Overview
Segmentation Only Counts If It Has Been Tested
Most networks are documented as segmented and behave as flat. Rule sets accumulate exceptions, temporary allows outlive their purpose, and a single misordered policy quietly reopens a path that the architecture diagram says is closed.
We combine offline configuration review with active testing from each network zone. Firewall, router, and switch configurations are analysed line by line, then the conclusions are proven by attempting the traffic the policy is supposed to block.
Internal testing extends to the identity layer, where Active Directory misconfiguration, credential exposure, and privilege escalation turn a foothold into domain compromise faster than any perimeter exploit.
Key activities
- Firewall rule base, ACL, and NAT policy review
- Policy order, shadowed rule, and permissive any-any analysis
- Network segmentation and VLAN isolation validation
- External perimeter and exposed service testing
- Internal network penetration testing from each zone
- Active Directory attack path and Kerberos abuse testing
- Privilege escalation and lateral movement validation
- Administrative access, jump host, and VPN review
- Router, switch, and network device hardening review
- Wireless network and guest isolation testing
- Logging, alerting, and detection coverage assessment
- Patch level and end-of-life system identification
Assessment Methodology
Firewall & Infrastructure Assessment Areas
A thorough review of your network perimeter, access controls, and compliance posture.
Network Architecture & Segmentation
Assess internal segmentation, DMZ design, VLANs, and routing to reduce lateral movement opportunities.
Vulnerability Scanning & Penetration
Perform network scanning, service review, and penetration testing on core infrastructure components.
Access Control & Identity
Verify administrative privilege models, account policies, MFA posture, and secure access workflows.
Monitoring & Logging Review
Review detection visibility across firewalls, routers, switches, and core services for anomaly response readiness.
Risk & Compliance Guidance
Provide actionable recommendations aligned to standards such as ISO 27001, NIST, and IEC 62443.
Deliverables
What You Receive
Every engagement closes with a documented, defensible evidence set that serves engineering, leadership, and audit at the same time.
Technical Findings Report
Every finding with reproduction steps, evidence, affected components, risk rating, and specific remediation guidance.
PDF reportExecutive Summary
Risk posture, business impact, and thematic root causes written for leadership and board reporting.
PDF / slidesRemediation Tracker
A structured issue list with severity, owner, and status columns that maps directly into your ticketing system.
XLSX / CSVRetest Certificate
Formal confirmation of which findings were verified as remediated, suitable for customers and auditors.
PDF attestationAttack Path Narrative
Chained walkthroughs showing how individual weaknesses combine into a realistic compromise scenario.
Report sectionDebrief Session
A live walkthrough with your engineering and security teams covering findings, priorities, and fix strategy.
Live sessionReporting Process
Risk Rating Model
Findings are rated on demonstrated exploitability and business impact, not scanner severity. Critical findings are escalated during testing rather than held for the report.
CriticalConfirmed exploitation with direct impact on data, safety, or availability. Reported within 24 hours of validation.
HighExploitable weakness with meaningful business impact or a reliable path to privilege escalation.
MediumRequires specific conditions or chaining, but materially weakens the security posture.
LowLimited impact in isolation. Tracked for hardening and defence-in-depth improvement.
InformationalObservations, hygiene items, and architectural recommendations with no direct exploitability.
Client Benefits
Outcomes You Can Measure
Infrastructure work should shrink the attack surface and prove that your controls actually stop what they claim to stop.
Segmentation Proven
Isolation between zones is tested from both directions and reported per rule, not per assumption.
Domain Paths Closed
Active Directory escalation routes are mapped end to end with the specific misconfiguration behind each hop.
Detection Validated
Every executed technique is timestamped so your SOC can confirm what was seen and what was missed.
Technology Coverage
Technologies We Test
Coverage spans enterprise network vendors, identity infrastructure, and the monitoring stack around them.
Firewalls & Edge
- Palo Alto
- Fortinet FortiGate
- Cisco ASA / FTD
- Check Point
- Sophos XG
- pfSense / OPNsense
- Juniper SRX
Network Infrastructure
- Cisco IOS / NX-OS
- Juniper Junos
- Arista EOS
- HPE Aruba
- MikroTik
- SD-WAN
- 802.1X / NAC
Identity Infrastructure
- Active Directory
- Entra ID
- ADFS
- LDAP
- RADIUS
- PKI / ADCS
- PAM solutions
Server Platforms
- Windows Server
- RHEL / Rocky
- Ubuntu Server
- VMware vSphere
- Hyper-V
- Proxmox
Remote Access
- IPsec / SSL VPN
- Zero Trust gateways
- Citrix
- RDP gateways
- Jump hosts
- Bastion services
Detection Stack
- Splunk
- Microsoft Sentinel
- Elastic SIEM
- Wazuh
- Suricata / Zeek
- EDR platforms
Standards Alignment
Compliance Mapping
Infrastructure findings are mapped to the frameworks that govern enterprise networks and industrial estates alike.
ISO/IEC 27001:2022
Annex A evidence for network security, segregation in networks, secure configuration, and technical vulnerability management.
IEC 62443-3-3 & 62443-2-1
Zone and conduit separation, system security requirements, and security programme evidence for the IT/OT boundary.
NIST Cybersecurity Framework 2.0
Network posture reported against Identify, Protect, and Detect outcomes with prioritised actions.
NIST SP 800-53 Rev. 5
Control evidence across AC, CM, SC, SI, and AU families for regulated infrastructure.
MITRE ATT&CK Enterprise
Executed techniques are logged with timestamps for detection validation and purple team follow-up.
MITRE ATT&CK for ICS
Where the estate includes plant networks, findings are additionally mapped to the ICS matrix.
| Standard | Where it applies | How this engagement supports it |
|---|---|---|
| ISO/IEC 27001 | ISMS certification and audits | Annex A.8 network and configuration evidence with retest attestation. |
| IEC 62443-3-3 | IT/OT boundary and plant zones | Zone and conduit validation with system requirement gap analysis. |
| NIST CSF 2.0 | Enterprise risk reporting | Function-level posture summary for board and audit committee reporting. |
| NIST SP 800-53 | Regulated infrastructure | Evidence for CA-8, RA-5, SC-7, and AC control families. |
| MITRE ATT&CK | SOC detection validation | Timestamped technique log for coverage gap analysis. |
| MITRE ATT&CK ICS | Industrial network segments | ICS technique mapping for plant-floor detection and response planning. |
Industry Expertise
Industries Served
We work with regulated and safety-critical manufacturers where a security failure carries operational, contractual, and certification consequences.
Automotive OEMs & Tier-1ECUs, telematics, and connected vehicle platforms
Industrial AutomationPLCs, SCADA, and plant-floor networks
IoT ManufacturersConnected products, gateways, and companion apps
Medical DevicesConnected diagnostics, monitoring, and hospital systems
Cloud & SaaSMulti-tenant platforms and customer-facing services
Enterprise Security TeamsInternal validation, assurance, and audit support
Engagement Workflow
How We Work With You
A predictable delivery model with defined checkpoints, so your teams know exactly what happens and when.
Scoping & Rules of Engagement
We agree targets, depth, timing windows, safety constraints, and escalation contacts before any testing begins.
Threat Modelling
Trust boundaries, attacker goals, and abuse cases are mapped so testing effort follows real business risk.
Execution & Validation
Manual, tool-assisted, and AI-accelerated testing with every finding reproduced and evidenced.
Reporting & Risk Rating
Technical detail for engineers, prioritised risk narrative for leadership, delivered in one report set.
Remediation Support
Direct access to the testing engineers while your teams design and implement fixes.
Verification Retest
A free retest of remediated findings confirms the fix holds and closes the engagement.
Questions
Frequently Asked Questions
Practical answers to what procurement, engineering, and security teams ask before an engagement starts.
Can you test without disrupting operations?
Yes. Configuration review is offline and non-intrusive. Active testing is scheduled in agreed windows, and denial-of-service techniques are excluded by default unless you specifically request resilience testing.
Do you cover Active Directory?
Active Directory is a core part of internal testing. We map attack paths from a standard user to domain administrator and report the specific misconfiguration enabling each step.
Do you test production systems?
Yes, where the environment and rules of engagement allow it. We agree timing windows, rate limits, and safety constraints up front, and we maintain a live escalation channel for the duration of the engagement. Where production testing is unacceptable, we test staging and validate configuration parity separately.
How long does a typical engagement take?
Most assessments run between one and three weeks of active testing, depending on scope size and depth. Scoping takes two to three working days, and the report is delivered within five working days of testing completion.
Is the retest really included?
Yes. One verification retest of remediated findings is included in the engagement fee, provided it is requested within 90 days of report delivery.
Who performs the testing?
Senior security engineers only. We do not staff engagements with junior analysts running scanner output, and the engineer who tested your environment is the engineer you speak to during remediation.
Ready to harden your network perimeter?
Let us validate your firewall policy, segmentation, and identity infrastructure against the techniques attackers actually use.