# Network Security Audit Guide

## A Complete Step-by-Step Guide to Auditing Your Network Security

### Introduction

This guide walks you through conducting a thorough network security audit for your homelab or small business network. No expensive tools required — everything uses free or open-source software.

## Phase 1: Asset Inventory

### 1.1 Document All Network Devices

Create a spreadsheet with:
- Device name and IP address
- MAC address
- Operating system and version
- Open ports and services
- Last security patch date
- Owner/responsible person

### 1.2 Network Mapping

Use `nmap` to discover all devices:
```bash
# Scan your entire subnet
nmap -sn 192.168.1.0/24

# Deep scan a specific device
nmap -sV -sC -O 192.168.1.100

# Scan for vulnerabilities
nmap --script vuln 192.168.1.100
```

## Phase 2: Port and Service Audit

### 2.1 Identify Open Ports

```bash
# Full TCP port scan
nmap -sS -p- 192.168.1.0/24

# UDP port scan (top 1000)
nmap -sU --top-ports 1000 192.168.1.0/24
```

### 2.2 Service Identification

For each open port, document:
- Service name and version
- Whether it should be exposed
- Whether it needs authentication
- Encryption status (TLS/SSL)

### 2.3 Close Unnecessary Ports

Common unnecessary services to disable:
- Telnet (23) — replace with SSH
- FTP (21) — replace with SFTP/SCP
- HTTP (80) — redirect to HTTPS
- RDP (3389) — restrict to VPN only
- SMB (445) — restrict to internal only

## Phase 3: Authentication Audit

### 3.1 Password Security

Check for:
- Default credentials on all devices (routers, switches, IP cameras)
- Password reuse across services
- Password strength (minimum 12 characters)
- Two-factor authentication enabled where available

### 3.2 SSH Security

```bash
# Check SSH configuration
cat /etc/ssh/sshd_config | grep -E "PermitRootLogin|PasswordAuthentication|Port|AllowUsers"

# Recommended settings:
# Port 22 (or custom)
# PermitRootLogin no
# PasswordAuthentication no
# AllowUsers yourusername
```

### 3.3 Service Accounts

- Audit all service accounts (nginx, postgres, etc.)
- Ensure no service runs as root
- Check sudo permissions
- Review cron jobs for privilege escalation

## Phase 4: Wireless Security

### 4.1 WiFi Audit

- Check encryption: WPA3 > WPA2-AES > WPA-TKIP (insecure)
- Check for rogue access points
- Verify guest network isolation
- Check WiFi password strength
- Disable WPS (Wi-Fi Protected Setup)

### 4.2 Wireless Scanning

```bash
# Scan for nearby access points
nmcli dev wifi list

# Check your own AP security
iwconfig wlan0
```

## Phase 5: Firewall Audit

### 5.1 Review Firewall Rules

```bash
# iptables (Linux)
iptables -L -n -v

# UFW (Ubuntu)
ufw status verbose

# pfSense/OPNsense
# Check via web UI: Firewall > Rules
```

### 5.2 Common Issues

- Default allow rules
- Missing outbound filtering
- No rate limiting
- No logging
- IPv6 not filtered

## Phase 6: Logging and Monitoring

### 6.1 Enable Logging

```bash
# Enable auth logging
journalctl -u sshd

# Check failed login attempts
grep "Failed password" /var/log/auth.log | tail -20

# Monitor real-time
tail -f /var/log/auth.log
```

### 6.2 Set Up Alerts

- Configure fail2ban for SSH protection
- Set up log forwarding to a central server
- Enable email alerts for critical events
- Monitor for unusual outbound connections

## Phase 7: Vulnerability Scanning

### 7.1 Nessus Essentials (Free)

1. Register at tenable.com/products/nessus-essentials
2. Install and configure
3. Run weekly scans
4. Document and remediate findings

### 7.2 OpenVAS (Free)

```bash
# Install OpenVAS
apt install openvas
gvm-setup
gvm-start

# Access web UI at https://localhost:9392
```

## Phase 8: Incident Response Plan

### 8.1 Create an Incident Response Plan

Document:
- Who to contact
- What to isolate
- How to preserve evidence
- Recovery procedures
- Lessons learned process

### 8.2 Backup Verification

- Test backup restoration monthly
- Verify 3-2-1 backup strategy
- Document recovery time objectives
- Test offsite backup access

## Phase 9: Compliance Checklist

### 9.1 Security Hardening Checklist

- [ ] All default passwords changed
- [ ] SSH key-based auth enabled
- [ ] Firewall configured (deny by default)
- [ ] Unnecessary services disabled
- [ ] Automatic security updates enabled
- [ ] Logs being collected and monitored
- [ ] Backups tested and verified
- [ ] Network segmented (VLANs)
- [ ] Guest WiFi isolated
- [ ] VPN for remote access
- [ ] 2FA on all admin interfaces
- [ ] Asset inventory complete and current

## Phase 10: Ongoing Maintenance

### Monthly Tasks
- Review new vulnerabilities (CVE feeds)
- Update all systems
- Review firewall logs for anomalies
- Test backup restoration
- Update asset inventory

### Quarterly Tasks
- Full vulnerability scan
- Review user access permissions
- Update incident response plan
- Review and update security policies
- Penetration test (basic)

### Annual Tasks
- Full security audit (this guide)
- Review all service accounts
- Update password policies
- Review and update network architecture
- Security training for all users

---

## Tools Used in This Audit

| Tool | Purpose | Cost |
|------|---------|------|
| nmap | Port scanning, service identification | Free |
| OpenVAS | Vulnerability scanning | Free |
| fail2ban | Brute-force protection | Free |
| Wireshark | Packet analysis | Free |
| Nikto | Web server scanner | Free |
| Lynis | Linux auditing | Free |
| Nessus Essentials | Vulnerability scanning (16 IPs) | Free |

---

*This guide is provided free by GeniusTechLab. For more guides, visit [geniustechlab.com](https://geniustechlab.com)*

*Last updated: August 2026*