Network Security Audit - Kiểm toán an ninh mạng: Quy trình chuyên nghiệp
Kiểm toán an ninh mạng là quá trình đánh giá độc lập, hệ thống các kiểm soát an ninh của tổ chức để xác định: Hiệu quả, Tuân thủ, Khoảng trống (Gaps), Rủi ro còn lại. Đầu ra: Báo cáo kiểm toán với Findings & Recommendations.
Quy trình kiểm toán an ninh mạng chuẩn (6 Bước)
- Planning (Lập kế hoạch):
- Xác định phạm vi (Scope): Network segments, Cloud, OT/IoT, Remote access, 3rd party
- Thu thập tài liệu: Network topology, Asset inventory, Policies, Previous audit reports, Compliance requirements
- Định nghĩa tiêu chí (Criteria): NIST CSF, ISO 27001, CIS Controls, PCI-DSS, HIPAA, Luật ATTT VN, Vendor best practices
- Chuẩn bị team & Công cụ
- Information Gathering (Thu thập thông tin):
- Interview: CISO, Network Admin, SysAdmin, App Owner, Helpdesk, Vendor
- Technical Discovery: Network scan (Nmap), Asset discovery (Lansweeper, RunZero), Config review (Router/Switch/FW/Load Balancer/Proxy/WLC), Log review (SIEM, FW, VPN, DNS, DHCP, Auth)
- Document review: Policies, Procedures, Diagrams, Change mgmt records, Incident logs, Vendor contracts
- Risk Assessment & Vulnerability Scanning (Đánh giá rủi ro & Quét lỗ hổng):
- Credentialed Vulnerability Scan (Nessus, Qualys, OpenVAS, Defender VM)
- Penetration Test (Internal/External) - Tùy scope
- Wireless Assessment (Wardriving, Rogue AP, WPA3/WPA2 config)
- Cloud Security Posture (CSPM - Wiz, Orca, Prisma, Defender for Cloud)
- Threat Modeling (STRIDE, PASTA) cho critical assets
- Control Testing (Kiểm tra kiểm soát):
- Firewall/NSG Rule Review: Shadow rules, Overly permissive (Any-Any), Unused rules, Logging enabled, Change mgmt traceability
- Segmentation Verification: VLAN/Subnet isolation, Micro-segmentation (NSX, Calico, Cilium), Zero Trust (ZTNA), East-West traffic control
- Access Control Review: Admin accounts, Privileged Access (PAM), VPN/RDP/SSH access, MFA enforcement, Service accounts, Certificates/PKI
- Encryption Verification: TLS 1.2+ everywhere, IPsec/WireGuard VPN, Disk encryption (BitLocker/LUKS), Database TDE, Key Management (HSM/KMS)
- Monitoring & Detection: SIEM coverage, Log sources completeness, Correlation rules tuning, Alert fatigue, Mean Time To Detect (MTTD)
- Incident Response Readiness: IR Plan current, Playbooks, Tabletop exercise (6 tháng/lần), Forensic readiness, Backup/DR tested (RPO/RTO)
- Physical Security: Data center access, Console access, Environmental controls, Asset disposal
- Vendor/3rd Party Risk: Vendor assessment, Contractual security clauses, 4th party risk, Supply chain (SBOM)
- Reporting & Follow-up (Báo cáo & Theo dõi):
- Executive Summary (Risch rating, Top 5 findings, Business impact)
- Detailed Findings: Condition (Sai gì), Criteria (Chuẩn gì), Cause (Nguyên nhân), Effect (Tác động), Recommendation (Khuyến nghị), Management Response (Đồng ý/Không đồng ý + Action plan + Deadline)
- Risk Rating: Critical / High / Medium / Low / Informational (Dựa trên CVSS + Business Context + Likelihood)
- Tracking: Gantt chart remediation, Status meeting hàng tháng, Re-test verification, Closure
Checklist kiểm toán nhanh (Quick Audit Checklist)
| Lĩnh vực | Kiểm tra then chốt (Key Checks) |
|---|---|
| Perimeter Firewall | Default deny, Rule cleanup (>6 tháng), Logging+Alerting, SSL Inspection, IPS/ATP enabled, HA/Failover tested, Change mgmt |
| Network Segmentation | DMZ, Server, User, IoT, Mgmt, Guest隔离. ACL/FW giữa zone. No flat network. Micro-seg for critical apps. |
| Remote Access / VPN | MFA bắt buộc, Cert-based auth, Split tunnel off, Posture check (Health attestation), Session logging, Idle timeout |
| Wireless | WPA2-AES/WPA3-Enterprise (802.1X), No WEP/WPA/TKIP, WPS OFF, Rogue AP detection, Guest isolation, Cert-based auth |
| Switch/Router Hardening | Disable unused ports, Port Security, BPDU Guard, Root Guard, DHCP Snooping, DAI, IP Source Guard, CoPP, Control Plane Policing, SSH v2 only, SNMPv3, NTP auth |
| DNS / DHCP / NTP | DNSSEC, RPZ/Blocking, DHCP Snooping/Option 82, NTP authenticated, Internal root hints |
| Vulnerability Management | Credentialed scan monthly, SLA patch (Critical 72h, High 30d), Exception tracking, Asset inventory accuracy >95% |
| Identity & Access | AD/Entra ID hygiene, Privileged accounts <5%, PAM for tier 0/1, Access review quarterly, Password policy (14+ char, no expiry if MFA), Kerberos armoring |
| Logging & Monitoring | Centralized log (SIEM), Retention 1+ year, Critical logs: FW, VPN, AD, DNS, Proxy, AV/EDR, Cloud, App. Alert tuning, 24/7 SOC or MDR |
| Data Protection | DLP Network/Endpoint/Cloud, Classification, Encryption at rest/transit, Key mgmt, Backup 3-2-1 immutable, Restore test quarterly |
| Cloud Security (AWS/Azure/GCP) | CSPM enabled, IAM least privilege, No public S3/Blob/Bucket, Security Groups/NSG restricted, GuardDuty/Defender/SCC enabled, IaC scanning |
| Endpoint Security | EDR/XDR deployed all endpoints, Tamper protection, ASR rules, App Control (WDAC/AppLocker), Disk encryption, USB control, Patch compliance >95% |
| Application Security | WAF (Block mode), API Gateway, SAST/DAST/SCA in CI/CD, Secret scanning, Runtime protection (RASP), Secure headers |
| Incident Response | IR Plan approved, Roles defined, Communication tree, Evidence preservation, Legal/LE liaison, Cyber insurance, Post-mortem process |
| Security Awareness | Training annual + New hire, Phishing sim quarterly (Click rate <5%), Reporting mechanism, Role-based training (Dev, Admin, Finance, Exec) |
| Governance & Compliance | Policy framework (ISO 27001/NIST CSF), Risk register, Exception process, Audit log integrity, Regulatory mapping (PCI, HIPAA, GDPR, VN Law) |
Công cụ hỗ trợ kiểm toán (Audit Tools)
- Network Discovery/Mapping: Nmap, Masscan, Lansweeper, RunZero, NetBox, Device42
- Config Audit/Compliance: Nipper, Tufin, FireMon, AlgoSec, RedSeal, Cisco Prime, SolarWinds NCM, Ansible/Terraform (IaC audit)
- Vulnerability Scanning: Nessus, Qualys, OpenVAS, Rapid7, Defender VM, Trivy (Container/IaC)
- Penetration Testing: Metasploit, Cobalt Strike, BloodHound, CrackMapExec, Nmap NSE, Burp Suite, SQLMap
- Log Analysis/SIEM: Splunk, Elastic, Sentinel, QRadar, Graylog, Wazuh, LimaCharlie
- Wireless: Kismet, Aircrack-ng, Ekahau, NetSpot, Wifite
- Cloud: ScoutSuite, Prowler, CloudSploit, Wiz CLI, Azure Security Benchmark, AWS Audit Manager
- Automation/Reporting: Drata, Vanta, Secureframe, AuditBoard, Custom PowerShell/Python scripts
3 Loại kiểm toán (Audit Types)
- External Audit: Big 4 / Specialized CPA firm / Certified Auditor. Độc lập, cho Board/Regulator/Client. Opinion: Unqualified/Qualified/Adverse.
- Internal Audit: Internal Audit Dept / IT Audit Team. Định kỳ, risk-based, advisory, follow-up. Report to Audit Committee/CISO.
- Compliance/Regulatory Audit: Nhà nước (Bộ TT&TT, Bộ Công An, Ngân hàng Nhà nước), PCI-QSA, HIPAA Auditor. Bắt buộc, penalty nếu fail.
Tại sao kiểm toán an ninh mạng quan trọng?
- Xác minh hiệu quả đầu tư an ninh (ROI Security)
- Phát hiện khoảng trống trước khi kẻ tấn công khai thác
- Tuân thủ pháp luật, chuẩn mực, hợp đồng (Avoid fines, Keep certifications)
- Cải thiện tư thế bảo mật liên tục (Continuous Improvement)
- Tạo bằng chứng cho Ban giám đốc, Nhà đầu tư, Khách hàng, Bảo hiểm Cyber
- Hỗ trợ Incident Response (Baseline bình thường, Asset inventory, Contact list)
Kết luận
Kiểm toán an ninh mạng không phải "đi kiểm tra" một lần. Là chương trình liên tục (Continuous Audit/Monitoring) với: Automation (IaC scanning, Config drift detection, Continuous vuln scan) + Human Expertise (Threat hunting, Architecture review, Business context) + Governance (Policy, Risk, Compliance, Reporting). Mục tiêu: Resilience (Kháng cự) > Compliance (Tuân thủ).