home

หน้าแรก
 Computer >> บทช่วยสอนคอมพิวเตอร์ >  >> ระบบเครือข่าย >> ความปลอดภัยเครือข่าย

ตรวจสอบความปลอดภัยเครือข่าย (Network Security Audit) ตรวจสอบอะไรบ้าง? คู่มือครบวงจร

Network Security Audit คืออะไร?

Network Security Audit คือกระบวนการตรวจสอบ ประเมิน และยืนยันว่าเครือข่ายองค์กรมีการควบคุมความปลอดภัยที่เพียงพอ เหมาะสม และทำงานได้จริง ตามนโยบาย มาตรฐาน (ISO 27001, NIST CSF, PCI-DSS) และข้อกำหนดทางกฎหมาย (PDPA, GDPR)

สิ่งที่ถูกตรวจสอบ (Audit Scope & Checklist)

1. Network Architecture & Segmentation

  • Network Topology Diagram (Updated, Accurate)
  • Segmentation: DMZ, Internal, Server, User, Guest, IoT/OT, Management, Cloud
  • Firewall Rules Review: Shadowed Rules, Overly Permissive (Any/Any), Unused Rules, Rule Recency
  • Routing & Switching Security: VLAN Design, PVLAN, VRF, Routing Protocol Auth (OSPF/BGP MD5/SHA)
  • Wireless Security: WPA2-Enterprise/WPA3, 802.1X, NAC, Guest Isolation, Rogue AP Detection

2. Perimeter & Boundary Defense

  • Border Firewall/NGFW: Rulebase, IPS/IDS Policies, SSL Decryption Coverage, Threat Prevention Signatures
  • DDoS Protection: On-prem / Cloud Scrubbing (Cloudflare, Akamai, AWS Shield)
  • Email/Web Gateway: Spam/Malware/Phishing Filtering, Sandbox, URL Rewriting, DMARC/DKIM/SPF
  • VPN/Remote Access: MFA, Certificate Auth, Posture Check, Split Tunneling Policy, ZTNA Migration
  • DNS Security: DNSSEC, RPZ, DNS Filtering (Cisco Umbrella, Infoblox, Quad9)

3. Network Access Control (NAC) & Identity

  • 802.1X (Wired/Wireless): Auth Server (RADIUS/ISE/ClearPass), Certificates, MAB Fallback
  • Device Profiling & Posture Assessment: OS, Patch Level, AV/EDR Running, Disk Encryption
  • Guest/Contractor Access: Sponsor Portal, Time-limited, Restricted VLAN
  • Privileged Access Management (PAM): Jump Server, Session Recording, Credential Vault, JIT Access

4. Monitoring, Detection & Logging

  • SIEM/Log Collection: Coverage (Firewall, Proxy, DNS, AD, VPN, Cloud, EDR, Apps), Retention (Hot/Warm/Cold)
  • Log Quality: Timestamps (NTP), Structured Parsing, Enrichment (GeoIP, Threat Intel, Asset Context)
  • Correlation Rules & Use Cases: MITRE ATT&CK Coverage, False Positive Rate, Tuning Process
  • Network Detection & Response (NDR): Traffic Analysis, Encrypted Traffic Analysis, Lateral Movement Detection
  • Threat Intelligence Integration: TIP, STIX/TAXII, IOC Feeds, Automated Blocking

5. Vulnerability & Patch Management

  • Network Device Firmware/OS: Version, CVE Exposure, Vendor Support Status (EOL/EOS)
  • Automated Scanning: Authenticated Scans, Credentialed, Frequency (Continuous/Weekly/Monthly)
  • Patch SLA: Critical ≤ 48 hrs, High ≤ 2 weeks, Medium ≤ 30 days, Low ≤ 90 days
  • Configuration Compliance: CIS Benchmarks, STIG, Vendor Hardening Guides (Golden Images)

6. Encryption & Cryptography

  • TLS/SSL: Version (1.2+ only), Cipher Suites (AES-GCM, ChaCha20-Poly1305), Certificate Validity, CT Logs
  • IPsec/VPN: IKEv2, AES-GCM, PFS (Perfect Forward Secrecy), Certificate-based Auth
  • Data at Rest: Database Encryption, Backup Encryption, Key Management (HSM/KMS), Key Rotation
  • Certificate Management: Inventory, Expiry Monitoring, Automation (ACME/cert-manager), Revocation Check

7. Incident Response & Resilience

  • IR Plan: NIST 800-61, Roles, Communication, Escalation, Legal/Regulatory Contacts
  • Tabletop Exercises: Quarterly, Scenarios (Ransomware, Data Breach, Insider, Supply Chain)
  • Backup/DR: 3-2-1 Immutable, RTO/RPO Tested, Air-gapped/Offline Copies
  • Network Resilience: HA/Clustering, Link Redundancy, Failover Testing, Chaos Engineering

8. Policy, Governance & Compliance

  • Security Policies: Acceptable Use, Access Control, Encryption, Incident Response, Vendor Management
  • Policy Review Cycle: Annual หรือ عند تغيير جوهري, Version Control, Approval Workflow
  • Compliance Mapping: Controls → Framework (ISO 27001 Annex A, NIST 800-53, PCI-DSS Req)
  • Risk Register: Asset, Threat, Vulnerability, Likelihood, Impact, Treatment, Owner, Status
  • Security Awareness: Phishing Simulation (Quarterly), Role-based Training, Metrics (Click Rate, Report Rate)

เครื่องมือสำหรับ Network Security Audit

หมวดเครื่องมือ
Network Discovery & MappingNmap, Masscan, runZero, NetBrain, SolarWinds NPM, Auvik
Vulnerability ScanningNessus, OpenVAS, Qualys VMDR, Rapid7 InsightVM, Tenable.io
Configuration AuditNipper, Nipper-ng, Cisco Prime, FortiManager, Panorama, Ansible/NetBox
Traffic AnalysisWireshark, Zeek, Suricata, NDR (Corelight, ExtraHop, Vectra)
Compliance/PolicyOpenSCAP, Lynis, CIS-CAT, Cloud Custodian, Prowler (AWS/Azure/GCP)
SIEM/Log AnalysisSplunk, Elastic, Sentinel, Graylog, Wazuh
Wireless AuditKismet, Aircrack-ng, Ekahau, NetAlly, Wi-Fi Analyzer
Penetration TestingMetasploit, Cobalt Strike, BloodHound, CrackMapExec, Nmap NSE

กระบวนการ Audit (Audit Process)

  1. Planning: Scope, Objectives, Criteria, Team, Timeline, Tools, Access Arrangements
  2. Fieldwork: Data Collection (Interviews, Document Review, Technical Scanning, Config Review)
  3. Analysis: Findings Classification (Critical/High/Medium/Low/Informational), Root Cause, Risk Rating
  4. Reporting: Executive Summary, Detailed Findings, Evidence, Recommendations, Remediation Timeline
  5. Follow-up: Track Remediation, Re-test, Close Findings, Continuous Monitoring

รายงาน Audit ควรมีอะไรบ้าง?

  • Executive Summary (Business Risk Language)
  • Scope & Methodology
  • Findings: Title, Risk Rating, Description, Evidence, Impact, Recommendation, CWE/CVE Reference
  • Compliance Gap Analysis
  • Remediation Roadmap (Prioritized, Owner, Timeline)
  • Positive Observations (What's Working Well)
  • Appendices: Tool Output, Config Excerpts, Network Diagrams

ทำไมต้อง Audit? (Business Value)

  • ค้นพบช่องโหว่ก่อน Attacker
  • พิสูจน์ Compliance (ลดค่าปรับ, โอกาสธุรกิจ)
  • ลด Cyber Insurance Premium
  • ปรับปรุง Security Posture อย่างต่อเนื่อง
  • สร้างความเชื่อมั่น Stakeholders (Board, Customers, Partners, Regulators)

ความถี่ที่แนะนำ

  • Internal Audit: ทุกไตรมาส (Focus Areas หมุนเวียน) + Comprehensive ทุกปี
  • External Audit: ทุกปี (ISO 27001, SOC 2, PCI-DSS) หรือตามสัญญา
  • Continuous Automated Assessment: Daily/Weekly (Vuln Scan, Config Drift, Compliance Checks)
  • Post-Incident / Post-Change: After Major Incident, Major Network Change, M&A