PROBLEM
Everything can see everything, and the “firewall” is years of exceptions — with no zone map or rule owner.
PODEJŚCIE
A zone sketch, listener inventory, who may talk to whom, and where you would see that they talked — then prioritised filter changes.
SCOPE
- addressing / VLAN / zone map in scope
- listener and exposure inventory
- filter rule and exception review
- traffic / device logging recommendations
DELIVERABLE
- zone and dependency sketch
- prioritised exposure list
- filter recommendations and rollout order
PROCESS
- map the environment
- exposure and exceptions
- risk priorities
- agreed change and verification
Network security without a map is guessing. Before adding another firewall exception we establish addressing, VLANs or at least a “what talks to what” list, which services are exposed, and who owns each rule.
I review exposure (ports, VPN, RDP, admin panels), propose segmentation in agreed scope, and show where you would notice a rule break (device logs, NetFlow, syslog). The goal: less flat network, fewer “open for a moment” holes, more control that survives reboot and staff change.
Out of scope at the start: production red team, attacking third-party Wi‑Fi, promising an invisible network.