Network, Firewall & Segmentation Security Assessment
Network, firewall and segmentation assessment to prioritize connectivity changes
Complex firewall rules and changing network boundaries can leave teams unsure which connections are necessary. ICA's scoped design and configuration review turns network, remote-access and segmentation findings into practical improvement priorities.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Make network changes with clearer priorities
Firewall exceptions have accumulated across years of application changes. Your team needs to decide which paths should remain open and where stronger separation deserves attention.
This assessment is intended for network directors, IT managers and CISOs facing complex rule sets or concerns about excessive connectivity. It gives technical owners a documented basis for reviewing access decisions. Leadership can use the findings to weigh network-security improvements against operational needs, rather than treating every rule change as an isolated task.
Review the boundaries that control connectivity
The agreed scope covers network architecture, firewall rules, remote access and segmentation design. Relevant evidence may include network diagrams, configuration exports and documented traffic requirements. The review considers how the selected controls separate environments and support approved business connections.
For example, a connection between a user network and an application environment should have a clear purpose. Remote-access pathways need similar context: who uses them, which resources they reach and where access is restricted. Scoping identifies the sites, devices and network boundaries under review. A selected-device review should not be read as coverage of every network path in the organization.
Compare intended design with configuration evidence
The core approach is design and configuration review. Discussions with network owners establish the purpose of selected connections and explain exceptions. Reviewing diagrams alongside firewall configurations helps identify mismatches between documented boundaries and the access rules that support them.
Findings distinguish observed configuration issues from questions that require more evidence. A rule's business purpose may need confirmation before an owner decides to narrow or remove it. Documentation alone does not demonstrate that a segmentation boundary blocks traffic in practice.
Active segmentation validation is separately scoped. Any such work requires written authorization, agreed assets and ownership, and rules of engagement. The review does not automatically include vulnerability scanning or penetration testing.
Turn findings into network-owner decisions
Typical deliverables are agreed in the engagement scope:
Network/control findings: Document the reviewed architecture and control observations. Technical owners can trace an issue to its relevant boundary or configuration evidence; leadership can understand the concern and coverage limits.
Rule-review recommendations: Identify firewall-rule questions and recommended changes for owner evaluation. Your team can use these recommendations to check business dependencies before approving changes through its own change-control process.
Segmentation improvement priorities: Explain which separation improvements warrant attention first. Use the priorities to plan work around critical connections and operating constraints.
Establish scope around your environment
Start with the decision you need to make: simplify a difficult rule set, review a changed network boundary or evaluate separation around important services. The engagement scope identifies relevant devices and remote-access pathways, then sets the depth of configuration review.
Prepare current diagrams, selected configuration evidence and the people who can explain application dependencies. If documentation is incomplete, identify those gaps during scoping. Agree how sensitive network information will be accessed and handled without assuming a particular transfer platform.
Device count, rule complexity, sites, evidence quality and client participation affect cost and timing. Platform fit and any active-validation requirements also need confirmation before an engagement is agreed.
Keep review, testing and remediation distinct
This assessment focuses on network design and configuration decisions. Active segmentation validation requires its own agreed scope. PCI-specific segmentation testing also requires explicit scope; this review should not be treated as that testing or as payment-security validation.
Hands-on remediation requires explicit scope. Firewall changes and network redesign remain with your delivery owners unless separately agreed. A penetration test addresses a different question through authorized attempts to demonstrate weaknesses. A vulnerability assessment focuses on identifying and prioritizing vulnerabilities. Choose those approaches when you need testing evidence beyond the architecture and configuration observations described here.
Questions about the network assessment
Who is this assessment best suited to?
Network directors, IT managers and CISOs who need clearer access and segmentation decisions. It is particularly relevant after network changes or when complex firewall rules make it difficult to explain why connectivity is permitted.
Will the review cover every firewall and network segment?
Coverage is agreed during scoping. Identify the devices, sites and boundaries that matter to your decision. The findings should make selected coverage clear so that a review of part of the environment is not mistaken for an organization-wide assessment.
Does reviewing segmentation prove that traffic is blocked?
Configuration evidence explains intended restrictions. Demonstrating behavior requires separately scoped active validation with authorization and agreed rules of engagement. The report should distinguish reviewed design from any controls actually validated within that additional scope.
What determines the assessment's cost and timing?
The number of devices and sites, rule-set complexity, review depth and evidence availability are key factors. Any active validation introduces additional scoping requirements. Fees and timing depend on the agreed engagement.
How does this differ from a network penetration test?
This review examines architecture and configuration evidence to recommend network-control improvements. An authorized penetration test attempts to demonstrate exploitable weaknesses within agreed boundaries. If your objective requires that evidence, discuss a testing scope rather than assuming it is included here.
Will ICA change rules or provide PCI segmentation testing?
Rule-review recommendations and segmentation priorities guide your team's decisions. Hands-on remediation and PCI-specific segmentation testing require explicit scope. The assessment does not include those activities by default or promise compliance, certification or a particular testing outcome.
Define the connectivity decisions that need attention
Bring the network change or access concern your team needs to resolve. Discuss a scoped assessment that connects architecture and configuration evidence to rule-review recommendations and segmentation priorities. A clear boundary between review, active validation and implementation helps you select the work that answers your actual question.
Make network changes with clearer priorities
Firewall exceptions have accumulated across years of application changes. Your team needs to decide which paths should remain open and where stronger separation deserves attention.
This assessment is intended for network directors, IT managers and CISOs facing complex rule sets or concerns about excessive connectivity. It gives technical owners a documented basis for reviewing access decisions. Leadership can use the findings to weigh network-security improvements against operational needs, rather than treating every rule change as an isolated task.
Review the boundaries that control connectivity
The agreed scope covers network architecture, firewall rules, remote access and segmentation design. Relevant evidence may include network diagrams, configuration exports and documented traffic requirements. The review considers how the selected controls separate environments and support approved business connections.
For example, a connection between a user network and an application environment should have a clear purpose. Remote-access pathways need similar context: who uses them, which resources they reach and where access is restricted. Scoping identifies the sites, devices and network boundaries under review. A selected-device review should not be read as coverage of every network path in the organization.
Compare intended design with configuration evidence
The core approach is design and configuration review. Discussions with network owners establish the purpose of selected connections and explain exceptions. Reviewing diagrams alongside firewall configurations helps identify mismatches between documented boundaries and the access rules that support them.
Findings distinguish observed configuration issues from questions that require more evidence. A rule's business purpose may need confirmation before an owner decides to narrow or remove it. Documentation alone does not demonstrate that a segmentation boundary blocks traffic in practice.
Active segmentation validation is separately scoped. Any such work requires written authorization, agreed assets and ownership, and rules of engagement. The review does not automatically include vulnerability scanning or penetration testing.
Turn findings into network-owner decisions
Typical deliverables are agreed in the engagement scope:
Network/control findings: Document the reviewed architecture and control observations. Technical owners can trace an issue to its relevant boundary or configuration evidence; leadership can understand the concern and coverage limits.
Rule-review recommendations: Identify firewall-rule questions and recommended changes for owner evaluation. Your team can use these recommendations to check business dependencies before approving changes through its own change-control process.
Segmentation improvement priorities: Explain which separation improvements warrant attention first. Use the priorities to plan work around critical connections and operating constraints.
Establish scope around your environment
Start with the decision you need to make: simplify a difficult rule set, review a changed network boundary or evaluate separation around important services. The engagement scope identifies relevant devices and remote-access pathways, then sets the depth of configuration review.
Prepare current diagrams, selected configuration evidence and the people who can explain application dependencies. If documentation is incomplete, identify those gaps during scoping. Agree how sensitive network information will be accessed and handled without assuming a particular transfer platform.
Device count, rule complexity, sites, evidence quality and client participation affect cost and timing. Platform fit and any active-validation requirements also need confirmation before an engagement is agreed.
Keep review, testing and remediation distinct
This assessment focuses on network design and configuration decisions. Active segmentation validation requires its own agreed scope. PCI-specific segmentation testing also requires explicit scope; this review should not be treated as that testing or as payment-security validation.
Hands-on remediation requires explicit scope. Firewall changes and network redesign remain with your delivery owners unless separately agreed. A penetration test addresses a different question through authorized attempts to demonstrate weaknesses. A vulnerability assessment focuses on identifying and prioritizing vulnerabilities. Choose those approaches when you need testing evidence beyond the architecture and configuration observations described here.
Questions about the network assessment
Who is this assessment best suited to?
Network directors, IT managers and CISOs who need clearer access and segmentation decisions. It is particularly relevant after network changes or when complex firewall rules make it difficult to explain why connectivity is permitted.
Will the review cover every firewall and network segment?
Coverage is agreed during scoping. Identify the devices, sites and boundaries that matter to your decision. The findings should make selected coverage clear so that a review of part of the environment is not mistaken for an organization-wide assessment.
Does reviewing segmentation prove that traffic is blocked?
Configuration evidence explains intended restrictions. Demonstrating behavior requires separately scoped active validation with authorization and agreed rules of engagement. The report should distinguish reviewed design from any controls actually validated within that additional scope.
What determines the assessment's cost and timing?
The number of devices and sites, rule-set complexity, review depth and evidence availability are key factors. Any active validation introduces additional scoping requirements. Fees and timing depend on the agreed engagement.
How does this differ from a network penetration test?
This review examines architecture and configuration evidence to recommend network-control improvements. An authorized penetration test attempts to demonstrate exploitable weaknesses within agreed boundaries. If your objective requires that evidence, discuss a testing scope rather than assuming it is included here.
Will ICA change rules or provide PCI segmentation testing?
Rule-review recommendations and segmentation priorities guide your team's decisions. Hands-on remediation and PCI-specific segmentation testing require explicit scope. The assessment does not include those activities by default or promise compliance, certification or a particular testing outcome.
Define the connectivity decisions that need attention
Bring the network change or access concern your team needs to resolve. Discuss a scoped assessment that connects architecture and configuration evidence to rule-review recommendations and segmentation priorities. A clear boundary between review, active validation and implementation helps you select the work that answers your actual question.