Baseline Network Assessment
- Prepared for
- Harbor Lane Advisory (fictional)
- Organization size
- About 60 employees, one office (fictional)
- Test window
- A three-day window in a fictional month; dates intentionally omitted
- Retest
- 21 days after the original test (fictional)
- Report status
- Sample for demonstration only
1. Executive summary
We tested the internal office network of Harbor Lane Advisory (a fictional firm) over an agreed three-day window. The goal was to find out whether weaknesses on ordinary staff workstations could give an attacker who already had a foothold a path to sensitive files, and how existing defenses responded along the way.
Endpoint protection performed well against the credential theft technique we tried. The bigger risk came from configuration: a shared local administrator password and an old name resolution feature together created a realistic route from one compromised laptop to the main file server. Both have straightforward fixes.
Top three actions: (1) give every workstation a unique local administrator password, (2) turn off legacy name resolution across the network, (3) require SMB signing on the file server. The retest in section 6 shows progress on the first two.
2. Scope and authorization
| Item | Agreed in writing |
|---|---|
| Authorized by | Fictional Chief Operating Officer, with the firm's IT provider notified |
| In scope | Internal office network 192.0.2.0/24 (a documentation-only address range), 40 workstations, 2 servers |
| Out of scope | Cloud email tenant, public website, phone system, any third-party hosted service |
| Starting point | A test laptop on the office network with a standard (non-admin) staff account, simulating a compromised device |
| Restrictions | No denial-of-service techniques, no changes to production data, business hours only |
| Stop contacts | Named contacts at the firm and its IT provider, with an agreed pause procedure |
3. Results by outcome
Each test is reported by what actually happened. We don't combine these into a single security score, because a number like that hides the detail you need to act.
| Outcome | Meaning in this report |
|---|---|
| Blocked | A control stopped the technique before it completed. |
| Detected | The technique completed, but a control raised an alert the firm's provider received. |
| Allowed | The technique completed and no alert was observed. This does not by itself prove a real attack would succeed end to end. |
| Inconclusive | The evidence wasn't strong enough to support a firm conclusion either way. |
| Not tested | Excluded from scope or not attempted. No conclusion is drawn. |
4. Findings
Shared local administrator password on workstations
AllowedPriority: High- Evidence summary
- Using credential material recovered from the test laptop, the tester authenticated as the local administrator on 3 of 3 sampled workstations. No alert was observed by the IT provider during the window.
- Business impact
- Control of one workstation can quickly become control of many, which shortens the path to sensitive client files.
- Suggested fix
- Deploy a tool that sets a unique, rotated local administrator password on each device, such as the password management feature built into current Windows versions. Remove the shared account where it isn't needed.
- Owner
- IT provider (fictional)
Legacy name resolution enabled on the network
AllowedPriority: High- Evidence summary
- Older name lookup protocols (LLMNR and NBT-NS) were active. During the window, the test laptop received authentication attempts from two workstations that could be used in further attacks. No alert was observed.
- Business impact
- An attacker on the network can collect credential material passively, without needing to break into anything first.
- Suggested fix
- Disable LLMNR and NetBIOS name resolution through group policy and confirm DNS covers all internal names.
- Owner
- IT provider (fictional)
SMB signing not required on the file server
AllowedPriority: Medium- Evidence summary
- The file server at 192.0.2.20 (documentation address) accepted unsigned SMB sessions. Combined with F-02, this could let captured authentication be relayed to the server.
- Business impact
- Raises the chance that a network-level attack reaches the firm's main document store.
- Suggested fix
- Require SMB signing on servers, starting with the file server. Test with a small group of workstations first to check for compatibility issues.
- Owner
- IT provider (fictional)
Credential dumping attempt on a workstation
BlockedInformational- Evidence summary
- An attempt to read stored credentials from memory on the test laptop was stopped by the endpoint protection product, and the event appeared in its console.
- Business impact
- Positive result. This control worked as intended for this technique on this device.
- Suggested fix
- No change needed. Keep the current policy and include this technique in future retests.
- Owner
- None
Outbound connection to a test server
DetectedPriority: Medium- Evidence summary
- The test laptop opened an encrypted connection to a tester-controlled server at a documentation address (198.51.100.10). The firewall raised an alert, which the IT provider saw about 40 minutes later. The connection was not blocked.
- Business impact
- Suspicious outbound traffic gets noticed, but not stopped, and the response time leaves a window for data to leave.
- Suggested fix
- Review outbound filtering rules and agree with the IT provider on a faster response for this alert type.
- Owner
- IT provider with firm leadership (fictional)
Remote access appliance firmware version
InconclusivePriority: Medium- Evidence summary
- The remote access appliance's firmware version could not be confirmed from inside the network. Its management page suggested an older release, but that alone isn't reliable evidence.
- Business impact
- Unknown. If the firmware is out of date, the appliance may be exposed to published weaknesses.
- Suggested fix
- Have the IT provider confirm the installed version against the vendor's current release and update if needed.
- Owner
- IT provider (fictional)
Email attachment handling
Not testedNo conclusion- Evidence summary
- The cloud email tenant was excluded from this scope, so no email tests were run.
- Business impact
- No conclusion drawn.
- Suggested fix
- Consider including email controls in a future scope if that's a concern.
- Owner
- None
5. Prioritized action plan
| Order | Action | Findings | Effort |
|---|---|---|---|
| 1 | Unique local administrator passwords on every workstation | F-01 | Low to moderate |
| 2 | Disable legacy name resolution by policy | F-02 | Low |
| 3 | Require SMB signing on the file server | F-03 | Low, test first |
| 4 | Tighten outbound filtering and alert response | F-05 | Moderate |
| 5 | Confirm remote access firmware version | F-06 | Low |
6. Retest results
The IT provider reported fixes for F-01, F-02 and F-03. We retested those three items only, as agreed in scope.
| Finding | Original | Retest | Notes |
|---|---|---|---|
| F-01 Shared local admin password | Allowed | Partly resolved | 2 of 3 sampled workstations now have unique passwords. One reception PC was missed by the rollout. |
| F-02 Legacy name resolution | Allowed | Resolved | No legacy name lookups observed during the retest window. |
| F-03 SMB signing | Allowed | Still open | Change postponed by the IT provider pending a compatibility check. Scheduled for next month. |
7. Limitations
This assessment covered the systems, techniques and time window listed in section 2. Results describe how those systems behaved during testing. They don't predict how the environment will respond to other techniques, to future changes, or to systems outside scope. A result of "allowed" means no control stopped or flagged the technique during the test; it doesn't by itself prove a real attack would succeed end to end.
Reminder: this entire report is an illustrative sample. Harbor Lane Advisory is fictional, all addresses come from ranges reserved for documentation, and no real organization was tested.