[Autogenerated] So.
Jacob.
Requirement one firewalls.
It's all about the network.
Close like a Layer three firewall is.
And it's not about application firewalls.
That's exactly right.
It is aboutthe layer three.
It's about the ports,
and the service is and the I P addresses And what network
traffic can get into the the in scope environment.
What can get out on how those networks are connected together?
Okay, so let's see.
Let's do certain role play.
Let's say you're about to walk on site, but you walked on site.
You're an assessor.
You're going for full PC ideas.
That's assessment of an entity you start with, you start.
Well, requirement one of the top I do.
But before I do that,
we talk about scoping and usually before we've come on site.
We've had some discussions about the scope,
about the architecture, about the environment,
data flow.
So we have some sense of what we're walking into some context on.
We ask fewer dumb questions that way.
But having done that, having,
having made sure we've got a really firm grip on scope or at
least understand where the unknowns are,
then yeah, we tend to move right into requirement one and say,
Let's talk about how you're doing your network device management,
Okay?
Right?
And we'll talk.
I think a little bit about cloud, you know, down the line.
But sometimes that's all there is,
Right are just cloud based network security kinds of devices,
right, rather than physical devices.
But sometimes there are still physical devices or a combination of the two.
And our approach is really kind of got two facets to it.
One is just how are you managing these devices?
Who gets access?
How how do you do?
Changes that kind of thing.
So you're looking a requirement wall and making sure that's documented 0.1,
right?
And then you're saying okay, you actually doing that right?
Are you actually doing this?
Do you have the documentation and then show us how you're managing these
devices in line with what you've described in your documentation,
right?
The second piece, the more complex piece,
is essentially are your firewall rules any good,
right?
Right.
And and that gets complicated very quickly.
Even a modestly complex firewall rule set can turn into spaghetti very,
very quickly.
So do you actually put hands on the firewall and start typing in command to say,
Show me the rules.
Would you get to print them out?
Or would you use a tool like a panorama or something like that?
Uh, generally, we will get our clients.
We won't get our hands on things.
Okay, we'll get our clients to show us things,
and maybe they'll give us a physical hard copy print out.
Maybe they will display something on screen for us in a conference room.
Sometimes they will give us ah file.
Or very often they will give us a file that we can
then parse with some tools right on.
And usually it's more just like a good text editor
with some search functionality.
Uh, but what we're looking for is having that in kind of one hand,
and in the other hand, there documentation for what their rules do,
right?
They need to know what's in their firewall and what it does.
Uh, and if they don't understand that, then our understanding of it is fruitless,
right?
S o,
if they can't give us meaningful justifications if they
can't give us meaningful explanations, not just here.
Is the syntax, right?
Yeah, but here is what purpose?
This rule fulfills for our organization.
Here is why it is still valid.
Here is why it points to the right sources or destinations,
you know, then that's that's the fundamental problem.