Network security assessment

What the assessment is

MagenX builds your network picture from three sources you already run: the computers Active Directory knows, each placed in its subnet and site, the records DNS holds, and the interfaces, routes and address objects on your FortiGate firewalls. From that picture it shows the subnets that mix tiers, the hosts running an operating system past support and the domain controllers everything depends on, and the asset discovery sweep adds how SMB is set on the hosts it finds.

The seven checks in the Network Topology category are the ones that raise findings. The larger part of the network layer is the map itself, which every other layer uses: an attack route needs to know which subnet a workstation is on before it can ask the firewall whether the workstation can reach a server.

What is examined

Where each host sits: its subnet, the site that subnet belongs to, and the firewall that places it
Segmentation between tiers: subnets that hold both domain controllers and workstations, and subnets where not one computer has a managed local administrator password
Hosts whose operating system is past its vendor's end of support, from the version the directory recorded, with the rule that a floor such as "Windows Server 2016 or later" is a policy statement and never a product
SMB posture, where the discovery sweep ran: the hosts that still answer SMBv1, and whether each one requires, offers or lacks signing, three different answers named as three
Domain controllers: which ones exist, which ones answer, and the replication and site topology between them, measured rather than pinged
The DNS map: computers with no forward record, internal names that point outside the forest, and, where the discovery sweep ran, names that point at addresses where nothing answers
Hosts on the network that no team claims, which is where the asset discovery page begins

The map is the product

Every host in the estate has one page, reached from any cell that names it. The page carries what the directory says about the machine, what DNS calls it, where the firewalls place it and what they publish to it, its host firewall policy where an endpoint console holds one, who is seated on it (observed, and inferred, never merged), and the results of the three engines run for that host: the crown-jewel analysis, the inbound attack simulation and the exposure matrix. The first moves an attacker would try against it are listed in one written order, exposure first, and that list is executed by the product's own checks.

Each host page shows where the directory places a host next to where the firewalls place it, so a stale record stands out at a glance.

Segmentation, judged by the rule that applies

Two subnets are only separated if the firewall between them denies the traffic, and a FortiGate decides that by the first matching policy in sequence order on the interface pair the traffic uses, never by the most specific rule. MagenX evaluates segmentation the way the device does, so a subnet that the network diagram calls isolated and a broad rule at sequence three connects to everything is reported as connected. A host's own firewall is consulted for the same packet where an endpoint console holds its policy, because the machine is the last hop.

Where it sits in the whole

Network findings combine with directory and firewall findings into one risk rating per subnet. A workstation that can reach an unpatched server is an inventory note; put that workstation on a subnet the firewall connects to the domain controllers and it becomes the first step of a route. Every finding carries its evidence, can be assigned as a follow-up with a due date, and the next scan shows whether the fix held.

What it does not do

It installs no software on the hosts it assesses, captures no traffic and reads no endpoint configuration. The network layer works from the directory, DNS and the firewalls and confirms its riskiest findings against the live hosts; the optional discovery sweep is described on its own page. It never exploits anything it finds.

FAQ

Can this run in an isolated network?

Yes. Every read on this page is inside the estate, the product installs from one installer on hardware you control, and results are produced and kept on site.

Does it need SNMP or credentials on network devices?

No. Firewall policy, interfaces and routes are read through the FortiManager API with a read-only profile. The optional discovery sweep can ask SNMP for four standard values, and that is off by default.

How does it know which subnet a host is on?

From each host's address and the site Active Directory documents for its subnet, and separately from the interfaces and routes your firewalls hold. The host page shows both side by side.

How is end of life decided?

From the operating system version the directory recorded for the computer, matched against the vendor's support dates. A version string that states a floor rather than a product is not matched, so a policy value cannot produce an end-of-life finding.

Is asset discovery part of this?

It is a separate, optional sweep with its own page. The network assessment works from the directory, DNS and the firewalls, and confirms its riskiest findings against the live hosts.