I want to run a network security audit internally before an external review, where should I start?

The first thing auditors will look for are externally exposed admin panels. Immediately check whether the management interfaces of your modem, router, or VPN device are accessible from the internet. If they are, block them completely from the outside world and restrict access solely to the local network.

Make sure to throttle your packet rate when scanning the local network. Running free scanners on their default aggressive profiles can cause older network printers to freeze or trigger port security shutoffs on switches. It's best to run these scans after office hours.

Doing your own scan won't replace an external audit. You can't easily spot logic flaws in a system you set up yourself. Free tools will only catch obvious port misconfigurations; an auditor will actively test for authentication bypasses and privilege escalation. Don't get overconfident.

Here is a straightforward plan you can start this weekend: 1) Scan your static IP address from an outside machine and map out open ports, 2) Complete firmware updates across all local network hardware, 3) Verify that legacy sharing protocols are disabled on the file server, 4) Reset passwords on all network gear using strong combinations.

before a similar audit, we checked every single device in the office and caught a forgotten open port and a backup drive that was still set to the factory password and fixing just those two got us through the audit on the first try.

Check whether shares on your file server can be accessed from any device on the company network without a password or using a guest account; that's where most points get deducted.

Before initiating internal security checks, it must be verified that system backups are complete and functional. It should be kept in mind that uncontrolled scanning activities may compromise data integrity.

our tech guy rebooted the router trying to run a scan and the whole office had no internet that morning definitely wouldn't recommend running vulnerability scanners during work hours imo.

I went through the same thing.

The opposite happened to me, that's why I'm writing. Hasty decisions become decisions you have to fix six months later.

Most time waste accumulates in tasks waiting for approval. Just leaving this note, it might be useful.

Let me speak from the other side; I'm on the supplier side. An automated scan report is not the same as a penetration test.

Same here.

The discussion got scattered, let me summarize. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

If it's your first time, start small; scaling comes later. This is my opinion, I'm not claiming it's absolute truth.

Here's how it went for us. When making decisions write down the worst-case scenario too, not just the best.

Just leaving this note, it might be useful.

Do you think this works at any scale? Mistakes made on the network security audit side are usually reversible but expensive.

Proven by experience.

There's a common mistake people make when doing this. An untested backup is not a backup.

Correct me if I'm wrong.

This thread is archived.

Good call starting this thread. The harder it is to reverse a decision, the slower you should make it.

If you have questions, write them; I'll answer as best I can.