Neal Spangler

Work Security & network

Network tested inside and out, then watched every week

I tested the office network from inside and outside, checked the findings and ranked the fixes by risk. A weekly scan reports new devices and changed ports.

MikroTik router
MikroTik router Photo: Uhernandez, CC BY 3.0
4phishing campaigns traced and blocked
24 of 24checked, with no matching worm indicators found
2large customers' replies out of quarantine

The problem

I needed to identify exposed devices and check what an outsider could reach. Phishing emails targeted the finance inbox, while some large customers' filters quarantined sales replies without sending a bounce.

What I did

  • Ran vulnerability assessments from a test machine inside the network and a throwaway cloud server outside it, then ranked the findings by risk.
  • A weekly scan that compares devices and open ports against a baseline and posts what changed, matching hardware addresses to cut false alarms.
  • Traced each phishing campaign through its redirects and look-alike domains, blocked what it used, and added DNS filtering for the office.
  • Swept the fleet for a self-spreading npm worm the week it surfaced, and added a 30-day wait before adopting new package versions.
  • Found outgoing mail was signed only with the provider's shared domain, then published the company's own signing key and confirmed it in message headers.
Assessment loop I assess the network from inside and outside, recheck serious findings and rank confirmed findings by risk. The resulting plan guides fixes, and a weekly baseline scan reports changed devices or ports. Assess inside and outside Verify checked twice Prioritize ranked by risk Fix ranked plan Re-scan weekly baseline changes flagged by the weekly scan start the next round Assessment and weekly change checks
Verified findings guide the fixes. A weekly scan reports changes to devices and ports.

What I took from it

Some serious-looking findings were false alarms when I checked them again. I verified them before putting them in the remediation plan, so the fixes were based on confirmed problems.

Privacy