Infrastructure Security Audit Report

Importance:

Active Directory is the core identity and access management service. This audit examines users, groups, organizational units, Group Policy Objects, replication health, trust relationships, and security configurations.

Importance: Critical infrastructure component that controls authentication and authorization for the entire organization.

AD CS provides public key infrastructure (PKI) capabilities including certificate issuance, revocation, and management. This audit examines certificate authorities, templates, and known vulnerabilities (ESC1-ESC7).

Importance: Compromised certificate services can lead to domain-wide privilege escalation.

AD FS provides single sign-on capabilities for federated identity scenarios. This audit examines certificate configurations, relying party trusts, claims rules, and security settings.

Importance: Federation services are critical for secure authentication to cloud and partner applications.

Importance:

Apache HTTPD security audit covering ServerTokens, directory security, SSL configuration, mod_security, and access controls.

Importance: Apache remains one of the most deployed web servers requiring careful security configuration.

Importance:

Brocade Fibre Channel SAN switch security audit examining fabric security mode, zoning configuration, ISL security, DCC policy, and default zone settings.

Importance: SAN switches control access to storage infrastructure and require strict security controls.

Importance:

Importance:

Cisco IOS device security audit covering VTY line security, AAA configuration, SNMP settings, enabled services, logging, ACLs, and configuration management.

Importance: Cisco network devices form the backbone of many enterprise networks and must be properly secured.

Cisco MDS SAN switch security audit covering zone security, fabric binding, FC port security, management protocols, and FLOGI database analysis.

Importance: MDS switches protect storage networks and must be secured against unauthorized access.

Cisco NX-OS security audit examining vPC configuration, Control Plane Policing (CoPP), RBAC roles, enabled features, password security, and logging configuration.

Importance: Nexus switches handle datacenter traffic and require enterprise-grade security controls.

Importance:

Importance:

Importance:

DHCP provides automatic IP address assignment. This audit examines scopes, leases, reservations, failover configurations, and authorization status.

Importance: DHCP security prevents rogue address assignment and network attacks.

DNS provides name resolution services essential for network operations. This audit examines zones, records, forwarders, dynamic update security, and DNSSEC configuration.

Importance: DNS vulnerabilities can enable man-in-the-middle attacks and service disruption.

Docker security audit covering daemon configuration, privileged containers, capabilities, volume mounts, image security, and socket exposure.

Importance: Container security is critical as misconfigured containers can compromise the host system.

Elasticsearch security audit covering X-Pack security, authentication, TLS configuration, network binding, and cluster health.

Importance: Search clusters often contain aggregated sensitive data from multiple sources.

Event log analysis for security monitoring. This audit examines security events, logon patterns, PowerShell activity, and audit policy.

Importance: Event logs are essential for threat detection and forensic investigation.

Exchange Server provides email, calendar, and collaboration services. This audit examines mailbox configurations, transport rules, DAG health, virtual directories, and security settings.

Importance: Email is a primary attack vector and contains sensitive organizational communications.

File servers store organizational data and documents. This audit examines share permissions, SMB configurations, DFS replication, quotas, and storage utilization.

Importance: Improper file server security can lead to data breaches and ransomware attacks.

FortiGate firewall security audit examining firewall policies, UTM profiles (AV, IPS, Web Filter), VPN configuration, FortiGuard connectivity, and admin security.

Importance: FortiGate firewalls protect network perimeters and internal segments from threats.

Importance:

Importance:

HAProxy security audit examining stats page exposure, SSL termination, ACL rules, rate limiting, and backend health check security.

Importance: Load balancers control traffic flow and can expose backend systems if misconfigured.

HPE Integrated Lights-Out (iLO) security audit via Redfish API covering user accounts, network protocols, IPMI, directory integration, and firmware status.

Importance: BMC/iLO interfaces provide out-of-band management and must be secured to prevent physical compromise.

HPE switch security audit covering management access, SNMP configuration, AAA settings, port security, DHCP snooping, and spanning tree protection.

Importance: HPE switches are widely deployed in enterprise networks and require proper security hardening.

Hyper-V provides server virtualization. This audit examines virtual machines, virtual switches, storage, replication, and security configurations.

Importance: Virtualization security is critical as VM escape can compromise the entire host.

Internet Information Services provides web hosting. This audit examines websites, application pools, SSL certificates, authentication, and security configurations.

Importance: Web servers are directly exposed to attacks and require careful security configuration.

Importance:

Juniper JunOS security audit covering user authentication, SSH configuration, SNMP security, logging, NTP, management restrictions, and routing protocol security.

Importance: Juniper devices provide critical routing and security functions in enterprise networks.

Kubernetes security audit examining RBAC configuration, pod security, network policies, secrets management, and admission controllers.

Importance: Kubernetes orchestrates containerized workloads and requires comprehensive security controls.

Importance:

Linux server security audit covering SSH configuration, firewall rules, user accounts, SUID/SGID binaries, kernel parameters, and security frameworks (SELinux/AppArmor).

Importance: Linux servers often host critical applications and databases requiring hardened configurations.

Importance:

MikroTik RouterOS security audit examining IP services, MAC server, neighbor discovery, firewall rules, user accounts, and package management.

Importance: MikroTik devices are powerful but often misconfigured, making security audits essential.

MongoDB security audit covering authentication, authorization, network binding, TLS configuration, and access control settings.

Importance: NoSQL databases like MongoDB are frequent targets due to common misconfigurations.

SQL Server provides database services. This audit examines instances, databases, logins, security configurations, and known vulnerabilities.

Importance: Databases contain sensitive business data and are high-value targets.

MySQL/MariaDB security audit examining anonymous accounts, root access, password policies, SSL configuration, and privilege assignments.

Importance: MySQL powers many web applications and requires proper security hardening.

Importance:

Nginx security audit examining SSL/TLS configuration, security headers, certificate expiration, rate limiting, and access controls.

Importance: Web servers are directly exposed to the internet and must be properly hardened.

NPS provides RADIUS authentication and authorization. This audit examines RADIUS clients, network policies, connection request policies, and authentication methods.

Importance: NPS controls network access for VPN, wireless, and wired 802.1X authentication.

Importance:

NVIDIA/Mellanox switch security audit for Onyx and Cumulus Linux platforms, covering management access, SNMP, AAA configuration, and port security.

Importance: High-performance switches used in data centers require proper security configuration.

Importance:

Oracle Database security audit examining default accounts, password policies, privileges, audit configuration, TNS listener security, and encryption settings.

Importance: Oracle databases store enterprise-critical data and are high-value targets for attackers.

Palo Alto firewall security audit covering security policies, threat prevention profiles, URL filtering, WildFire, SSL decryption, admin authentication, and logging.

Importance: Next-generation firewalls are critical perimeter security controls requiring comprehensive configuration review.

Importance:

PostgreSQL security audit covering authentication methods (pg_hba.conf), SSL configuration, user privileges, extensions, and logging settings.

Importance: PostgreSQL is widely used for web applications and contains sensitive application data.

Print servers manage printing infrastructure. This audit examines printers, drivers, ports, and PrintNightmare mitigations.

Importance: Print services have been targets of critical vulnerabilities (PrintNightmare).

Importance:

Deep reconnaissance of Active Directory configuration including sites, subnets, LAPS deployment, SPNs, printers, ACLs, and DC services.

Importance: Identifies attack surface and misconfigurations commonly exploited by attackers.

Redis security audit examining authentication, ACL configuration, protected mode, dangerous commands, TLS, and persistence security.

Importance: In-memory data stores can expose session data and cached credentials if unsecured.

Importance:

Importance:

Importance:

Deep security analysis covering delegation attacks, Kerberos configuration, NTLM settings, GPO security, and advanced threat indicators.

Importance: Identifies advanced security risks and attack paths in the environment.

Importance:

Enterprise storage array security audit (NetApp, Dell EMC, Pure Storage, HPE) covering authentication, network protocols, encryption at rest, snapshot policies, and KMIP integration.

Importance: Storage systems hold critical business data and require comprehensive security hardening.

Importance:

Tape library security audit (IBM, HPE, Quantum, Dell) examining access control, tape encryption, key management (KMIP/EKM), network protocols, and maintenance status.

Importance: Tape libraries are critical for backup and compliance, requiring proper encryption and access controls.

Ubiquiti device security audit (UniFi, EdgeSwitch, EdgeRouter) covering default credentials, firewall rules, SNMP configuration, and management access.

Importance: Ubiquiti devices are common in SMB environments and must be properly secured.

Veeam provides backup and disaster recovery. This audit examines backup jobs, repositories, replication, encryption, and backup status.

Importance: Backup infrastructure is critical for ransomware recovery and business continuity.

Importance:

VMware provides enterprise virtualization. This audit examines ESXi hosts, virtual machines, datastores, networking, and security configurations.

Importance: VMware infrastructure hosts critical workloads and requires comprehensive security.

Comprehensive Windows operating system security audit covering updates, services, firewall, local users, security settings, BitLocker, Defender, scheduled tasks, audit policy, and PowerShell configuration.

Importance: Windows servers and workstations are primary targets and require comprehensive hardening.

Importance: