Network Security Audit (การตรวจสอบความปลอดภัยเครือข่าย) คืออะไร?
กระบวนการประเมินอย่างเป็นระบบ เพื่อวัดประสิทธิภาพของการควบคุมความปลอดภัยเครือข่าย ต่อต้านภัยคุกคามภายในและภายนอก ระบุช่องโหว่ ช่องว่าง (Gaps) และความไม่ปฏิบัติตามนโยบาย/มาตรฐาน เพื่อนำไปปรับปรุงให้ดีขึ้น
ขั้นตอนการทำ Network Security Audit (Network Security Audit Process)
Phase 1: Planning & Preparation (วางแผนและเตรียมการ)
- Define Scope: ระบุ Assets, Networks, Systems, Locations, Cloud Environments ที่จะ Audit
- Establish Criteria: มาตรฐานอ้างอิง - NIST CSF, ISO 27001, CIS Benchmarks, PCI-DSS, HIPAA, 組織 Policy
- Assemble Team: Internal Auditors, External Auditors, Subject Matter Experts, IT Staff
- Gather Documentation: Network Diagrams, Policies, Procedures, Configurations, Previous Audit Reports, Asset Inventory
- Risk Assessment: ระบุ High-risk Areas ให้ Audit ก่อน (Risk-based Approach)
- Rules of Engagement: Time Windows, Notification, Emergency Contacts, Rollback Plans
Phase 2: Information Gathering & Discovery (การรวบรวมข้อมูลและการค้นพบ)
- Asset Discovery: Network Scans (Nmap, Nessus), CMDB, Cloud Asset Inventory, DHCP/DNS Logs, ARP Tables
- Network Mapping: Topology, VLANs, Subnets, Firewalls, DMZ, Cloud VPCs, VPN Connections
- Configuration Review: Firewall Rules, Router/Switch Configs, VPN Settings, Wireless Settings, Load Balancers
- Traffic Analysis: NetFlow/sFlow, PCAP Analysis, Bandwidth Utilization, Anomalous Patterns
- Vulnerability Scanning: Authenticated + Unauthenticated Scans (Internal/External)
Phase 3: Control Testing & Evaluation (การทดสอบและประเมิน Controls)
| Control Area | กิจกรรม Audit |
|---|---|
| Firewall/Perimeter Security | Rule Base Review (Shadowed, Redundant, Overly Permissive, Any-Any Rules), Change Management, Log Review |
| Network Segmentation | VLAN Isolation, East-West Firewalls, Micro-segmentation, Zero Trust Network Access, DMZ Design |
| Access Control (AAA) | RADIUS/TACACS+, MFA, Privileged Access Management (PAM), Admin Account Review, Service Accounts |
| VPN & Remote Access | Split Tunneling, MFA, Certificate-based Auth, Posture Assessment, Session Logging, Idle Timeouts |
| Wireless Security | WPA2/WPA3, 802.1X/EAP-TLS, Guest Network Isolation, Rogue AP Detection, Client Isolation |
| Monitoring & Detection | SIEM Coverage, Log Sources, Correlation Rules, Alert Tuning, Mean Time to Detect (MTTD) |
| Incident Response | IR Plan, Playbooks, Tabletop Exercises, Forensic Readiness, Evidence Preservation, Communication Plan |
| Patch & Vulnerability Management | Patch Cycle, SLA by Severity, Exception Process, Vulnerability Scan Results, Remediation Tracking |
| Encryption & PKI | TLS 1.2+ Everywhere, Certificate Management, Key Rotation, HSM, IPsec/MACsec |
| Physical Security | Data Center Access, Rack Locks, Environmental Monitoring, Console Access Control |
| Cloud Network Security | Security Groups/NSGs, VPC Flow Logs, Transit Gateway, Private Endpoints, CSPM Findings |
Phase 4: Wireless & Physical Security Assessment
- War Driving / Wireless Site Survey - ระบุ Rogue APs, Weak Encryption, Signal Leakage
- Physical Access Test - Tailgating, Badge Cloning, Server Room Access, Cable Taps
- IoT/OT Device Security - Default Credentials, Firmware Versions, Network Segmentation
Phase 5: Penetration Testing (Optional but Recommended)
- External Pen Test - Internet-facing Assets
- Internal Pen Test - Assume Breach, Lateral Movement, Privilege Escalation
- Wireless Pen Test - WPA2/3 Cracking, Evil Twin, Client-side Attacks
- Social Engineering/Phishing Simulation
Phase 6: Reporting & Remediation
- Executive Summary: High-level Findings, Risk Rating, Business Impact, Priorities
- Detailed Findings: Finding ID, Description, Evidence, Risk Rating (Critical/High/Medium/Low), Recommendation, Reference
- Remediation Plan: Action Items, Owner, Target Date, Compensating Controls (ถ้า Remediate ไม่ได้ทันที)
- Presentation: ให้ Management, IT, Audit Committee
- Tracking: Follow-up Audits, Verification of Remediation
Network Device Audit (การตรวจสอบอุปกรณ์เครือข่าย)
Focus: Switches, Routers, Firewalls, Load Balancers, Wireless Controllers
- Configuration Hardening (CIS Benchmarks, Vendor Hardening Guides)
- Firmware/OS Version - End of Life/Support Check
- Management Plane Security: SSH Only (No Telnet), HTTPS Only, SNMPv3, MFA for Admin
- Control Plane Policing (CoPP), Routing Protocol Authentication (OSPF/BGP MD5/SHA)
- Logging: Syslog, SNMP Traps, NetFlow, AAA Accounting
- Time Synchronization (NTP) - สำคัญสำหรับ Log Correlation
- Backup Configurations (Offsite, Encrypted, Version Controlled)
เครื่องมือช่วย Audit (Audit Tools)
- Vulnerability Scanners: Nessus, Qualys, OpenVAS, Rapid7
- Network Discovery: Nmap, Masscan, Advanced IP Scanner
- Config Audit: Nipper, Router Audit Tool (RAT), Cisco Prime, SolarWinds NCM
- Traffic Analysis: Wireshark, Zeek (Bro), ntopng, NetFlow Analyzers
- Wireless: Kismet, Aircrack-ng, Ekahau, Acrylic
- Compliance/Framework: OpenSCAP, Lynis, CIS-CAT, AWS Config, Azure Policy
- SIEM/Log Analysis: Splunk, Elastic, QRadar, Sentinel, Graylog
Best Practices
- Annual Comprehensive Audit + Quarterly Focused Audits (Firewall, Wireless, Cloud, Privileged Access)
- Continuous Monitoring แทน Point-in-time Audit (SIEM, CSPM, Continuous Compliance)
- Automate Config Drift Detection, Vulnerability Scanning, Compliance Checks
- Rotate Auditors (Internal ↔ External) เพื่อมุมมองใหม่
- Integrate với Risk Management - Audit Findings → Risk Register → Treatment Plan
- Measure Metrics: Findings by Severity, Mean Time to Remediate (MTTR), Recurring Findings Rate, Coverage %
ทำไม Security Audit สำคัญ?
- ระบุ Security Gaps ก่อนที่ Hacker จะหาเจอ
- รับประกัน Compliance (กฎหมาย/มาตรฐาน/สัญญา)
- สร้างความเชื่อมั่นให้ Stakeholders (Board, Customers, Partners, Regulators)
- ปรับปรุง Security Posture อย่างต่อเนื่อง (Continuous Improvement)
- Justify Security Budget และ Investments
