Skip to content
sibwara edited this page Mar 26, 2025 · 79 revisions

Open Corporate Network Security Project (OCNSP) Testing Guide v0.4

Defense in Depth approach

The security concept called defense in depth postulates that each abstraction layer of the information system (from human to RJ45) must have its own security measures since none of them, alone, is infallible.

Knowledge: Cartography of the information system

(OCNSP-CART-001) Audit network's cartography
(OCNSP-CART-002) Audit machines' cartography
(OCNSP-CART-003) Audit users' cartography

Physical protection

(OCNSP-PHYS-001) Review physical entrances of the buildings
(OCNSP-PHYS-002) Enumerate physical access to Layer 1
(OCNSP-PHYS-003) Test access to server room and patch bay
(OCNSP-PHYS-004) Test access to sensitive assets
(OCNSP-PHYS-005) Test network access through outdoor equipment

Network security

(OCNSP-NETW-001) Test for presence of network segmentation
(OCNSP-NETW-002) Test access control between the segments of the network
(OCNSP-NETW-003) Test for the presence and configuration of a dedicated admin subnet
(OCNSP-NETW-004) Test for the presence and configuration of one or more DMZ
(OCNSP-NETW-005) Test for private/public Wifi segmentation with the main network
(OCNSP-NETW-006) Test for the presence and configuration of VoIP networks
(OCNSP-NETW-007) Test for SCADA/ICS segmentation with the main network
(OCNSP-NETW-008) Test for interconnection security with Internet
(OCNSP-NETW-009) Test for interconnection security with remote premises
(OCNSP-NETW-010) Test for interconnection security with partner networks (OCNSP-NETW-011) Test high availability mechanisms
(OCNSP-NETW-012) Test presence of low layer protocols protection
(OCNSP-NETW-013) Test Network Access Control mechanisms

Protocols

(OCNSP-PRTC-001) Test for presence/usage of cleartext protocols
(OCNSP-PRTC-002) Test for presence/usage of unsigned protocols prone to poisoning
(OCNSP-PRTC-003) Test for presence/usage of deprecated protocols
(OCNSP-PRTC-004) Test for presence of unauthenticated services
(OCNSP-PRTC-005) Test for presence of redundant protocols
(OCNSP-PRTC-006) Test WiFi security

Infrastructure

(OCNSP-INFR-001) Test known vulnerabilities due to outdated OS
(OCNSP-INFR-002) Test known vulnerabilities due to outdated firmware
(OCNSP-INFR-003) Test for default or predictable credentials
(OCNSP-INFR-004) Test Known Exploited Vulnerabilities against Public-Facing equipment
(OCNSP-INFR-005) Test for printers misconfiguration
(OCNSP-INFR-006) Test for IPBX misconfiguration
(OCNSP-INFR-007) Test for Camera misconfiguration
(OCNSP-INFR-008) Test for DNS server misconfiguration
(OCNSP-INFR-009) Test for e-mail server misconfiguration
(OCNSP-INFR-010) Test for Virtual Manager misconfiguration
(OCNSP-INFR-011) Test for Backup server misconfiguration
(OCNSP-INFR-012) Test for Active Directory misconfiguration

Operational Technologies (OT)

TODO

Applications

(OCNSP-APSC-001) Check for superfluous programs or services on servers
(OCNSP-APSC-002) Test for known vulnerabilities due to outdated technologies
(OCNSP-APSC-003) Apply OWASP against Web applications
(OCNSP-APSC-004) Test for default or predictable credentials
(OCNSP-APSC-005) Test for Databases misconfiguration
(OCNSP-APSC-006) Test for docker misconfiguration

Data

(OCNSP-DATA-001) Test for anonymous share access
(OCNSP-DATA-002) Enumerate sensitive data storage locations
(OCNSP-DATA-003) Test for different permission through different protocols (NFS, SMB, ...)
(OCNSP-DATA-004) Test users' privilege over sensitive shared folders
(OCNSP-DATA-005) Look for sensitive data in common shares
(OCNSP-DATA-006) Test presence of production data in testing environments

Endpoints

(OCNSP-HOST-001) Review endpoint encryption
(OCNSP-HOST-002) Test for BIOS/UEFI modification
(OCNSP-HOST-003) Test for local Administrator reuse
(OCNSP-HOST-004) Test for VoIP end points phones
(OCNSP-HOST-005) Test for OS misconfiguration
(OCNSP-HOST-006) Test for thick clients
(OCNSP-HOST-007) Check for superfluous programs or services
(OCNSP-HOST-008) Test for overprivileged user on workstations

Users

(OCNSP-AWRN-001) Test for user vigilance over physical entrances
(OCNSP-AWRN-002) Test for sensitive data leak through unsecured support
(OCNSP-AWRN-003) Test for unlocked active sessions
(OCNSP-AWRN-004) Test for vigilance about suspicious activity
(OCNSP-AWRN-005) Test for users'passwords resistance to bruteforce/dictionnary attacks

Reaction capabilities

(OCNSP-REAC-001) Audit detection capabilities
(OCNSP-REAC-002) Audit incident response capabilities
(OCNSP-REAC-003) Audit recovery capabilities (backup)

For any question/support about this project, please visit: www.astar.org.

Clone this wiki locally