Source: [LinkedIn](https://www.linkedin.com/pulse/network-security-ask-gerardus-blokdyk/)  
Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)  
Publication date: February 10, 2022  
Retrieved from on February 10, 2022

Relevant ISO 27001 clauses/controls:
- [ISO 27001 A.13.1 Network security management](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A.13.1%20Network%20security%20management.md)
- [[ISO 27001 C 9.2 Internal audit]]
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)
- [ISO 27001 A.18.2 Information security reviews](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A.18.2%20Information%20security%20reviews.md)

# Network Security: Ask This;
1. Is your organization logging any network events that would allow you to determine if a data security breach may have occurred?

2. Do you have insight in regular updates that shows all the latest security patches and the status of every machine on your network so you know your systems have been secured and updated?

3. Where business partners and/or third parties need access to information system is the network segregated using perimeter security mechanisms as firewalls?

4. To what extent has your organization implemented security controls to prevent data exfiltration and enhance network defenses?

5. Is a base network stack satisfactory (for a system locked in a secure area for example), or does a full featured network stack with a complete security portfolio make more sense?

6. Do your staff members have appropriate awareness, knowledge and skills to maintain the security of the network and information systems that support your delivery of essential services?

7. What wireless network security controls do you have in place to secure your network from hackers sitting in your parking lot and capturing your data?

8. Does your organization have a process to verify security policy compliance of all network connected devices?

9. Which technology and business factors does your organization use to structure network based security strategies?

10. Do your security systems detect insider misuse, misconfigured devices and unauthorized attempts to access internal network resources in real time?

11. When user access requirements increase because of business needs, what change management process is in place to modify the access controls.

12. BYOD environments pose capacity planning and security challenges, how does your organization track network access by non organization issued devices?

13. Does your organization employ a Network Access Control (NAC) solution to enforce security policies for remote users?

14. Does your organization have a process to deploy security updates to all network connected IT assets?

15. Where identified as necessary in your risk assessment, have you identified and segregated critical business systems and applied appropriate network security controls to them?

16. How do you know if the security controls implemented in your network have been configured correctly to protect your information?

17. Do you have a written Incident Recovery Plan for security incidents and network outages in force to avoid business interruption due to systems failure?

18. Does your organization perform (or have an experienced third party consultancy perform) external penetration tests at least quarterly and internal network security audits at least annually?

19. Does your organization have an independent testing program that includes comprehensive penetration testing of its perimeter network and application security controls?

20. Does your organization still need the sophisticated inspection capabilities of a standalone IPS?

21. How do you manage cooperation among networks to cope with natural faults and attacks where each network has its own policies with attendant security and privacy needs?

22. Are your network security vendors moving their portfolios in a direction that will allow you to fully exploit a Secure Edge or SASE architecture?

23. How many different platforms do you have to use to oversee your entire network security as well as your core networking capabilities?

24. Is your organization planning to approach network security in the cloud in the same manner as it does with its on premise security operations?

25. How does your organization position network security solutions to accommodate change while not, or at least not noticeably, impacting network performance?

26. Do you have recovery procedures documented for production and non production environments in the event of a service disruption?

27. Based upon your organizations business application plans and IT initiatives, how important is it for your organization to automate its network security operations in the future?

28. As more network traffic is encrypted, how concerned is your organization that your existing security monitoring practices/technologies will miss malware hidden in encrypted files?

29. Do you have a written Incident Recovery or Business Continuity plan in force for network security incidents and network outages?

30. What are the motive, means, and opportunity of each human threat actor who might use network access to violate the security requirements of your organizations critical asset?

31. How could using the vendors cloud infrastructure weaken your organizations existing network security posture?

32. What impediments do you encounter that prevent you from making greater use of network data for security detection and investigation?

33. If you are considering a large network service provider, system integrator or outsourcer for managed security services, whose staff will be monitoring or managing your security devices?

34. What is the difficulty in your organization of inserting malicious data into security related datasets in intrusion detection alerts, network packets and system logs?

35. How do you know if application and network security is sufficient to protect against data breaches?

36. Do the remote access security controls allow network devices to be isolated when there is a compromise?

37. Which organizational challenges between the networking and IT security teams in relation to network security do you have?

38. Have you automated network wide IPAM auditing processes with reports to show internal security standing and policy compliance?

39. What security credentials (e.g., for user access, network access or service access) are stored on each device?

40. Your organization changes, your network changes, and the threat landscape changes. How does your network security infrastructure adapt?

41. What have you done to validate that any network security controls are still effective with an increasingly remote workforce?

42. Which security operations management best practice is followed to enable appropriate network access for administrators?

43. What security priorities are most important for your organization to take as the number of staff in corporate locations/on the corporate network ramp back up?

44. How much time does the network security team spend on firewall audits, both in preparation and in the audit itself?

45. What policies are in place that address specific aspects of IAM as network security or physical access cards?

46. Does the integration of network flow capture with behavioral analysis and anomaly detection provide greater security intelligence in your organization?

47. What is the security posture of the systems (from file servers to databases, directory services and network devices) that support your most critical line of business?

48. Do your security policies address both internal and external access to the network for each technological device?