What are the best ways to learn from network security testing and auditing feedback?

Don't wait for the auditor to tell you what you're doing wrong. Be proactive and look for vulnerabilities and misconfigurations yourself. Don't be afraid to ask questions if you don't understand the auditor's findings or recommendations. Don't just fix the symptoms. Try to understand the root causes of the vulnerabilities and misconfigurations. Prioritize the recommendations based on how important they are and how much risk they pose. Implement the recommendations as soon as possible. Track your progress and make sure that the recommendations are working. Repeat the process regularly to stay ahead of the latest threats.

1. Review Reports Thoroughly 2. Prioritize Vulnerabilities 3. Understand Root Causes 4. Implement Remediation Measures 5. Engage Security Experts 6. Educate Staff 7. Continuous Monitoring 8. Follow Security Best Practices 9. Incident Response Planning 10. Regular Testing 11. Document Changes 12. Engage in Red Team Exercises 13. Stay Updated 14. Feedback Loop 15. Post-Incident Analysis

You learn more by doing. It doesn't have to be a large change, but making even a small iteration on your process, policy, or procedure after its tested can go a long way.

We need to understand at first place that having an updated and complete inventory of what is connected to the network and based upon the principle of nobody administrates what they don’t know. Once’s you have identify you can go over and conduct the security reviews, scans, verification, remediations and continues monitoring and documentation, in that way you may have a clear level of risk and the counter measures. It’s always good to take this actions at least once a year the recommended timing its every six months and every time something changes.

Testing and auditing is to cement what you have already done. . You need that second pair of eyes but good solid design and understanding of what you are building is paramount. Segment it , secure it , scan it then bury the keys and passwords in a vault. Leave nothing open and don't assume.

Reviewing the findings and recommendations is valuable for a continuous monitoring program. Obviously, the findings need to be addressed as soon as possible since these are potentially harmful shortcomings of your program, so taking this process seriously is more important than trying to find where to place the blame for the findings. Carefully consider the recommendations from the auditors because they could potentially prevent new findings from appearing in future audits and keep the current ones from recurring. Again, the process is not meant to attack the organization but to help it be as secure as possible.

Personally, I go through each item of feedback to verify, research and implement industry recommendations. Some testing tools are faulty especially open source tools and give wrong results. Therefore, it is important to verify each finding and thoroughly scrunise the report.

Very often asset owners will ask if this is real or theorical, and if it is real how to solve it and how to replicate internally the issue. So i think hiring that service can help any company to gain confidence that all issues have a potential solution that you can implement.

Don’t rest on your laurels. In some cases an auditor or assessor might have very little or no findings. The strength of an audit or assessment rests with the knowledge and tools at the disposal of the audit team. Do your due diligence. Just because you pass an audit or assessment with little to no findings or feedback does not mean there aren’t issues or areas of improvement. Also, if you receive feedback that you find to be lacking, seek an understanding from the audit team. Remember, they are also there to help you and they will bring a different perspective.

If you do get risk estimations for certain vulnerabilities from third-party vendors, then take the time to evaluate them in your context as third-party vendors rarely have the same level of understanding the impact of this vulnerability in the context of your company. Also, if you are faced with a huge number of vulnerabilities, you have to prioritize. Vendors have different solutions for that, and building only upon impact is usually not enough, which is why we are looking for enhancing this information with threat intel, such as, how often or if the vulnerability is already exploited. Public scoring systems, such das CVSSv3.1 or EPSS already can integrate such information and my be a starting point.

Collaboration with stakeholders is the lifeblood of effective network security testing and auditing. It’s not just about uncovering vulnerabilities; it’s about working together to protect your network. By sharing feedback and insights with network engineers, administrators, and other team members, you create a unified front against potential threats. Remember, security is a collective effort. By involving everyone, you not only address issues more comprehensively but also build a culture where security is a shared responsibility. It’s a win-win for everyone involved.

The importance of understanding the scope and objectives of testing and auditing cannot be overstated. It's the crucial foundation for effective feedback utilisation. Different assessments, such as penetration testing and vulnerability scanning, serve distinct purposes - one simulates attacks, the other identifies weaknesses. Likewise, internal and external audits focus on compliance and industry alignment. By grasping these distinctions, we gain the insight needed to prioritise our actions based on the feedback received.

Collaboration with the stakeholders is a powerful tool. It allows you to put more eyes and minds on a potential problem to come to a solution that everyone can agree to. When reviewing the results and recommendations of an audit, communication, and collaboration is a means to ensure that all stakeholders have a complete and mutual understanding of what the results are and the way forward for the organization to address any deficiencies.

Before communicating the results you need to determine several things to ensure those results are understood and acted upon. The main points I prioritize are: 1. Understand Your Audience: Tailor your message to their level of technical expertise and their specific interests. 2. Create a Clear Report: Prepare a comprehensive report summarizing the audit's objectives, methodology, findings, and recommendations. 3. Detailed Findings: Present the detailed findings of the audit. 4. Explain the Significance: For each finding, explain the potential impact. 6. Recommendations: Provide clear, actionable recommendations for addressing each finding. 7. Mitigation Plan: Outline a plan for mitigating the identified issues.

Sharing insights from network security evaluations isn't a monologue but a group discourse. Engage with stakeholders—engineers, managers, auditors, to name a few—sharing findings, seeking their insights, and aligning on roles and responsibilities in addressing issues. It’s a collective stride towards bolstering network security. This dialogue seeds a culture of awareness and accountability, turning recommendations into actionable steps. It’s not merely about fixing what's broken, but fostering a collaborative ethos, a shared pledge to uphold network security, and a step towards a safer digital frontier.

Approach to planning and executing remediation and improvement actions for network security is comprehensive and aligns with best practices like Prioritization of Actions Resource Allocation Task Assignment Documentation of the Plan Progress Tracking Testing and Verification Risk Mitigation Documentation of Results: Continuous Improvement By following these steps, can address immediate security concerns & establish a systematic and adaptive approach to network security. Regular testing, feedback, and improvement cycles contribute to the overall resilience and effectiveness of the security measures in place.

I personally find that changes in an organisation's performance/risk/negative audit findings are one of a few reasons that an organisation will change its controlled environment. Building a culture that embraces that change is difficult, recognising that change is necessary and going to happen in a predictable manner makes it easier for organisations to improve their security posture. We often work within environments that use continual process improvement models to address and structure change activities as part of remediations which enables them to embrace that change in a structured well-defined manner.

It is imperative that remediation plans and plans of action are followed through to completion. Set achievable and meaningful deadlines and ensure to update the plans as you go. The success of the plans of actions relies heavily on having the right people performing the work so ensuring the teams are right sized with the proper resources is crucial. And communicate, communicate, communicate. All stakeholders should be “in the know” to the status of the plans.

Develop and implement an action plan to address the identified vulnerabilities based on the recommendations provided in the feedback. Ensure adequate resources and support are allocated for fixing the weaknesses. Regularly track progress and revisit the network security infrastructure to validate if the implemented remedies are effective.

Define KPIs: These KPIs could include metrics such as the number of successful security incidents detected, response time to incidents, security patch compliance, firewall rule violations, or the availability and uptime of critical security systems. Utilize SIEM can help you identify potential security incidents, anomalies, and vulnerabilities by centralizing and monitoring security events across your network. Real-Time Alerts and Notifications can be sent via email, SMS, or integrated with your incident response system to ensure timely action is taken to mitigate any potential threats. Incident Response and Forensics after an incident can provide valuable insights into the root causes and further improve security measures.

Vulnerability Management System: Implement a robust vulnerability management system to track, prioritize, and monitor the progress of remediation efforts. Automate vulnerability scanning and reporting to streamline the identification and tracking of vulnerabilities. Employee Training and Awareness: Provide training and awareness programs for employees to help them understand the importance of cybersecurity and their role in protecting the organization. Share anonymized examples from network security testing and auditing results to illustrate real-world risks and encourage vigilance.

Don't underestimate or overlook the basics. Ensure the basics are in place before getting sucked in to the latest buzzword terms. Testing is a great way to validate controls. Sometimes you may assume products do things but test as per your use cases to ensure these work in the manner you want. Auditing can help highlight areas that might have been overlooked and can help in providing evidence to regulators to aid compliance.

As an advice, I would recommend: Stay accountable, automate where possible, debrief regularly, communicate openly, prioritize risk, comply with regulations, promote ownership, measure effectiveness, collaborate with trusted partners, and stay updated on emerging threats.

Following best security practices and guidelines. Be a part of security community to learn more about security and research reading article and research papers . It will help you to be updated and you will be able to stand out of crowd using proactive approaches in security.

Have a retest in six months time to check if all security issues raised have been mitigated or fixed. Penetration testing should be done annually.