Technical Control Assessment

Network Security & Access Management

Evaluating Network Security Controls

Network security controls form the first line of defense against external threats and unauthorized internal access. As an auditor, you must evaluate whether the organization has implemented appropriate controls to segment, monitor, and protect its network infrastructure. This includes reviewing firewall configurations, network segmentation strategies, VPN implementations, wireless network security, and network access control mechanisms.

• Firewall Rules and Policies: Are firewall rules based on the principle of least privilege? Are there overly permissive rules (such as allow-all rules) that should be tightened? Is there a regular review process for firewall rule sets?
• Network Segmentation: Is the network properly segmented to isolate sensitive systems? Are production, development, and testing environments separated? Is the cardholder data environment isolated per PCI DSS requirements?
• Remote Access Controls: Are VPN connections encrypted with strong protocols? Is multi-factor authentication required for all remote access? Are remote access logs monitored and reviewed?
• Wireless Network Security: Are wireless networks encrypted with WPA3 or WPA2-Enterprise? Are guest networks isolated from the corporate network? Are rogue access point detection mechanisms in place?

Access Management and Identity Controls

Access management controls ensure that only authorized users can access systems and data, and that their access is limited to what is necessary for their job functions. This is commonly referred to as the principle of least privilege. Auditors should evaluate the entire access lifecycle, from provisioning through periodic review to de-provisioning, looking for gaps that could allow unauthorized access.

• Identity and Access Management (IAM): Is there a centralized identity management system? Are user accounts uniquely assigned and not shared? Is role-based access control (RBAC) implemented?
• Privileged Access Management: Are administrative and root accounts properly controlled? Is there a privileged access management (PAM) solution in place? Are privileged sessions monitored and recorded?
• Multi-Factor Authentication (MFA): Is MFA implemented for all remote access, administrative access, and access to sensitive systems? What types of MFA factors are used?
• Access Reviews: Are periodic access reviews conducted (at least quarterly for privileged access, semi-annually for standard access)? Are access rights promptly revoked when employees leave the organization?

Endpoint Protection & Encryption

Evaluating Endpoint Security

Endpoints — including workstations, laptops, mobile devices, and servers — represent the most common attack surface in modern organizations. As remote and hybrid work has become standard, endpoint security has grown in importance. Auditors must evaluate whether endpoints are adequately protected against malware, unauthorized access, and data theft, and whether the organization maintains visibility and control over its endpoint fleet.

• Endpoint Detection and Response (EDR): Is an EDR solution deployed across all endpoints? Is it configured to detect and respond to advanced threats? Are alerts monitored and investigated promptly?
• Anti-Malware Protection: Is anti-malware software deployed on all endpoints? Are definitions updated automatically? Is real-time scanning enabled?
• Host-Based Firewalls: Are host-based firewalls enabled on all endpoints? Are the rules configured to restrict unnecessary inbound and outbound connections?
• Mobile Device Management (MDM): Are mobile devices enrolled in an MDM solution? Can lost or stolen devices be remotely wiped? Are security policies enforced on mobile devices (screen lock, encryption, application restrictions)?
• Device Hardening: Are endpoints hardened according to CIS Benchmarks or equivalent standards? Are unnecessary services and applications removed? Are default credentials changed?

Encryption Controls

Encryption is a critical control for protecting data confidentiality, both at rest and in transit. Auditors must evaluate the organization's encryption strategy, key management practices, and implementation across all relevant systems. Weak or misconfigured encryption can give a false sense of security and leave sensitive data exposed.

• Data at Rest: Are databases, file systems, and backup media encrypted? What encryption algorithms and key lengths are used? Are they compliant with current standards (AES-256 minimum for sensitive data)?
• Data in Transit: Is TLS 1.2 or higher used for all data transmissions? Are deprecated protocols like SSL 3.0 and TLS 1.0 disabled? Are certificate management practices sound?
• Key Management: Is there a formal key management policy? Are encryption keys stored separately from encrypted data? Is key rotation performed on a regular schedule? Who has access to encryption keys?
• Full Disk Encryption: Is full disk encryption enabled on all laptops and mobile devices? Is it centrally managed? What happens if the recovery key is lost?

Patch & Vulnerability Management

The Importance of Patch Management

Unpatched vulnerabilities are one of the most common attack vectors exploited by threat actors. Effective patch management is a fundamental security control that directly reduces the organization's attack surface. As an auditor, you should evaluate whether the organization has a structured process for identifying, testing, and deploying patches across all systems in a timely manner.

• Patch Policy: Is there a formal patch management policy that defines timelines for patch deployment based on severity (e.g., critical patches within 72 hours, high within 7 days, medium within 30 days)?
• Patch Testing: Are patches tested in a non-production environment before deployment to production? Is there a rollback procedure if a patch causes issues?
• Patch Coverage: Are all systems included in the patch management process, including operating systems, applications, firmware, and network devices? Are third-party applications covered?
• Patch Compliance Reporting: Does the organization track patch compliance metrics? What percentage of systems are fully patched? How is compliance measured and reported?
• Emergency Patching: Is there a process for expedited patch deployment when critical zero-day vulnerabilities are disclosed?

Vulnerability Management Program

Vulnerability management goes beyond patching to include the continuous process of identifying, classifying, prioritizing, and remediating security weaknesses across the entire technology environment. A mature vulnerability management program uses automated scanning tools, maintains a risk-based prioritization approach, and tracks remediation progress against defined SLAs.

• Scanning Frequency: Are vulnerability scans conducted regularly (at least monthly for internal scans, quarterly for external scans per PCI DSS)? Are scans triggered after significant changes to the environment?
• Scan Coverage: Does the scanning program cover all assets, including cloud resources, containers, and IoT devices? Are there gaps in coverage?
• Risk-Based Prioritization: Are vulnerabilities prioritized based on factors like CVSS score, exploitability, asset criticality, and business context? Or does the organization simply remediate all highs and criticals without business context?
• Remediation Tracking: Are vulnerability remediation activities tracked with defined SLAs? What is the average time to remediate critical, high, medium, and low vulnerabilities? Are there aging vulnerabilities that have exceeded their SLAs?

Logging, Monitoring & SIEM

The Role of Security Logging

Security logging provides the evidence trail that enables detection, investigation, and response to security incidents. Without adequate logging, an organization cannot detect breaches, investigate incidents, or demonstrate compliance with regulatory requirements. Auditors should evaluate whether the organization captures the right events, stores logs securely, and retains them for an appropriate period.

• Log Sources: Are logs collected from all critical systems, including servers, databases, network devices, firewalls, applications, and cloud services? Are authentication events, access events, and administrative actions all logged?
• Log Content: Do logs capture sufficient detail for investigation, including timestamps, source and destination addresses, user identities, actions performed, and success/failure status?
• Log Integrity: Are logs protected against tampering? Are they stored on systems separate from the sources that generate them? Is write-once storage or log signing used?
• Log Retention: Does the organization have a defined log retention policy? Does it meet regulatory requirements (PCI DSS requires 12 months of audit logs, with the most recent 3 months immediately available)?

Security Information and Event Management (SIEM)

A SIEM solution aggregates log data from multiple sources, normalizes it into a common format, correlates events to detect patterns indicative of security incidents, and provides alerting and reporting capabilities. SIEM is a critical component of an organization's detection and response capabilities, and its effectiveness depends on proper configuration, tuning, and monitoring.

• Data Source Coverage: Are all critical log sources integrated into the SIEM? Are there blind spots where events could occur without detection?
• Correlation Rules and Use Cases: Are correlation rules defined for common attack patterns (brute force, privilege escalation, data exfiltration, lateral movement)? Are rules regularly tuned to reduce false positives?
• Alert Monitoring: Who monitors SIEM alerts? Is there 24/7 coverage, or are alerts only reviewed during business hours? What is the average time to acknowledge and investigate an alert?
• Incident Escalation: Is there a defined process for escalating SIEM alerts to the incident response team? Are severity levels and escalation criteria clearly documented?

Continuous Monitoring

Continuous monitoring extends beyond SIEM to encompass an ongoing awareness of information security, vulnerabilities, and threats. It includes network monitoring, endpoint monitoring, cloud workload monitoring, and threat intelligence integration. Auditors should evaluate whether the organization has a holistic monitoring strategy that provides visibility across all environments and can detect both known and unknown threats in a timely manner.