SAMPLE-NET-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Network, VPN and Firewall Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
One fictional office network with one firewall, a VPN and two Wi-Fi networks, from administrator-supplied exports.
Executive summary
The network is functional but flat and aged. A published remote desktop rule, VPN accounts without MFA, a firewall far behind its vendor’s current firmware, and guest Wi-Fi that can reach internal services are the main risks.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Firewall rule export | 86 rules | Provided; secrets removed |
| E-02 | VPN configuration screenshots | 1 gateway | Provided |
| E-03 | Network diagram | 1 site | Provided; 18 months old |
| E-04 | Wi-Fi settings | 2 SSIDs | Provided |
| E-05 | Device firmware list | Firewall, 6 switches, 5 access points | Provided |
| E-06 | Logging settings | Firewall and VPN | Provided |
What was not checked
- Live reachability and open ports
- Switch port configuration
- Endpoint firewalls
- Cloud networks
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | Inbound rule forwards remote desktop (TCP 3389) to a server | E-01 | Remove the rule and provide access through the VPN with MFA, as CISA advises against exposing remote desktop. |
| F-02 | High | Firewall firmware not updated for 3 years | E-05 | Review the vendor’s security advisories for the model and plan a tested update. |
| F-03 | Medium | 12 VPN accounts use a password only; 4 unused for over 90 days | E-02 | Require MFA and remove unused accounts. |
| F-04 | Medium | Servers, printers and users share one network | E-03 | Plan segments for servers, users, printers and guests with rules between them. |
| F-05 | Medium | Guest Wi-Fi can reach the internal DNS server and one file server | E-04, E-01 | Isolate the guest network and allow only internet access. |
| F-06 | Low | Logs kept for 7 days on the device only | E-06 | Send logs to a central store with a longer retention. |
Fix first
- Remove the published remote desktop rule Effort: Low.
- Plan and test the firewall firmware update Effort: Medium.
- Require MFA on the VPN and remove unused accounts Effort: Medium.
- Isolate guest Wi-Fi Effort: Low.
- Design network segments Effort: High.
30/60/90-day plan
- First 30 days: Remove the remote desktop rule; isolate guest Wi-Fi; remove unused VPN accounts.
- By 60 days: Firmware update after advisory review; MFA on the VPN; central logging.
- By 90 days: Segment the network in stages; update the diagram; set a half-yearly rule review.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.