Skip to content

Latest commit

 

History

History
224 lines (204 loc) · 6.17 KB

README.md

File metadata and controls

224 lines (204 loc) · 6.17 KB
Raw

Network Health Checklist

A checklist of items to check, especially when inheriting a foreign network.

This list is meant to be a prompt sheet for getting an overview of a network in order to understand and make recommendations, as well as perform basic health check. It is not a survey that you can get a client to complete.

Servers

  • How many servers?
  • Is virtualization being used?
    • Virtual platform? (VMware/Xen/HyperV etc)
  • What operating systems are installed?
    • Windows NT4 (!!), 2003 (!!), 2008 (!!), 2008 R2 (!!), 2012, 2012 R2, 2016
    • Linux
    • Solaris/HP-UX/Other Unix
  • File Servers
  • NAS devices
  • Is there a SAN? Fibre Channel or iSCSI?
  • Check disk utilization of File Servers / NAS / SAN.
  • Are there UPS units installed? Operational?

All Servers

Check the following items:

  • free disk space
  • disk health
    • RAID health
    • RAID level; none (!!), RAID0 (!!), RAID1, RAID5(!), RAID6, RAID10, ZFS
  • running processes
  • memory utilization
  • pending updates
  • multi-homing

Windows Servers

Check the following items:

  • disk fragmentation
  • network file shares
  • local admin accounts

Linux Servers

Check the following items:

  • distribution and release
  • load average
  • mountpoints (local and remote)
  • listening ports
  • logged in users
  • host firewall
  • uptime

Website

  • Website hosting provider? (External/Internal)
  • Website developer(s)?
  • Deployment stack?
    • Web Server
    • Database - Scheduled Backups?

Email

  • Email hosting platform? (Google Apps, Rackspace, Self-hosted etc)
  • Self-hosted platform? (Exchange, Kerio Connect etc)
  • Server Address, Ports
  • Anti-spam and Anti-virus protection?
  • Public MX records?
  • SPF records? DKIM?

Active Directory

  • Is Active Directory installed?
  • What is the:
    • Forest:
    • Domain(s):
  • Is the domain(s) public or private?
    • Public: Is the domain registered to the business?
  • Is there any OU structure in place?
  • How many Domain Controllers are there?
    • Is there at least 1 physical Domain Controller?
    • What is the state of replication? (repadmin /showrepl * /errorsonly)
  • What roles are installed on what servers? (eg, DC, DHCP, DNS, Print Server, File Server)
  • Where are the FSMO roles held? (netdom query /domain:<DOMAIN> FSMO)
  • Are there any domain trusts configured?
  • Are there any Group Policy Objects:
    • Configured?
    • Linked to OU?
  • Is there a password policy in place?
    • Change every X days
    • Complexity?
    • Number of passwords remembered?
  • Are there DFS namespaces being used for file shares?

Network

  • What IP subnet is being used on the LAN?
  • Router/Gateway IP address (LAN):
  • Internet Connectivity:
    • ISP & Connection Type (ADSL, cable, fibre etc)
    • Are there static IP Address(es)
    • Router - hardware make/model
  • Are there VLAN's in use?
  • Are there multiple Layer 3 networks on a single Layer 2?
  • Any internal routers in-use to segregate internal networks/subnets?
    • See Routing Section

Firewall

  • Is there a permieter firewall in place?
  • Is egress traffic filtered?

DNS

  • Does the network have DNS redundancy? (2 or more working DNS servers)
  • Locally authorative DNS zones:

DHCP

  • DHCP server:
  • DHCP scope:
  • Check for rouge DHCP servers.

Routing

  • How many routers are installed?
    • Make/Models
    • Any configured in High Availability (HA)?
    • Are they edge or internal routers?
  • Is there firewalling between internal subnets?
  • Interfaces
    • Names (system and friendly names)
    • Capabilities (Speed, Media etc)

Switches

  • How many switches are installed
    • Make/Models
    • Utilization (port usage) of each switch
  • Speed/capabilities
    • 10/100mbps -- Gigabit?
    • Copper -- Fibre?
    • SFP's or Media Converters in place?
  • Switch topology:
    • Star
    • Daisy-chain
    • Mesh
  • Managed Switches:
    • Check interfaces for:
      • Dropped packets.
      • CRC errors.
      • Forced speed/duplex.
    • Is there any Port Security enabled?
    • Check STP is enabled
      • Is the STP root set correctly?
      • Is BPDU Guard enabled?
    • DHCP Snooping - Enabled? Required?
  • Uplink Design:
    • Single port uplinks between switches?
    • LACP/LAGG uplinks?
    • Redundant Paths?

Wireless

  • Wireless network installed?
  • What are the SSID's?
  • Security:
    • Open / No Security (!!)
    • WEP (!!)
    • WPA/WPA2 PSK
    • WPA2 Enterprise (802.1x)
    • Mac Filtering
  • Hardware:
    • Make/Models
    • 802.11a/b/g/n/ac
  • Management method (individual AP's, central management etc)
  • Is coverage sufficient?
  • Check for Rogue Access Points (on or off SSID)
  • Check channel spacing with surrounding SSID's

Security

  • Do users have Local Admin rights?
  • Do any users have remote access?
    • Remote Desktop
    • Citrix
  • Are there VPN services in place?
    • Site-to-site
    • Road warrior
    • IPSec / PPTP (!!) / SSL
  • Are there SSL/TLS protections in place for:
    • Corporate website
    • Email retrieval (POP3/IMAP/ActiveSync)
    • Email sending (SMTPS)
    • Public or self-signed certificates?
    • What are the SSLLabs test results?
  • Are logs centrally stored (Splunk/Greylog/Logstash etc)?
  • Is there any form of NAC (eg, 802.1x)?
  • Auditing; are there any compliance requirements? (PCI, SOX etc)
  • Have patches for major vulnerabilities been applied to: Servers? Desktops? Others?
    • Meltdown
    • Spectre
    • Heartbleed
    • Shellshock

Active Directory

  • Do users have Domain Admin rights?
  • Are there additional enterprise/domain admin accounts besides "Administrator"?
  • Are old users/computers disabled/deleted from Active Directory?

Backups

  • What backup processes are in place?
  • Have test restoration of backup been done?
  • Are there off-site backups being made?
  • Shadow Copies enabled on Windows file servers?

End-user Devices

  • How many:
    • Desktops
    • Laptops
    • Tablets
    • Smartphones
  • Is there any MDM in place for Phones/Tablets etc?

Software

  • Operating systems:
    • Windows XP (!!)
    • Windows Vista (!!)
    • Windows 7 (!!)
    • Windows 8
    • Windows 10
    • OS X
    • Linux
  • Productivity software (eg Microsoft Office)?
  • Anti-virus protection?
  • Business/Industry specific applications?
  • Are there any instances of Dropbox, OneDrive, Google Drive etc?
    • If yes, is it authorized or is it Shadow IT?
  • Are there any instances of TeamViewer, LogMeIn etc?
    • If yes, is it authorized or is it Shadow IT?