Configuration Review
Security Configuration Assessment
Expert analysis of firewall rules, OS hardening, cloud configs, and network devices against security baselines.
What is Configuration Review?
Misconfiguration is the leading cause of cloud data breaches and a top-five cause of network compromises. A single overly permissive firewall rule, a forgotten management port, or a default credential on a network device can be the entry point for a sophisticated attacker — regardless of how much was spent on perimeter defences.
Our Configuration Review service performs a systematic comparison of your firewall policies, server hardening state, network device configurations, and cloud infrastructure settings against industry-recognised security baselines — CIS Benchmarks, vendor hardening guides, and your own internal security policy.
Unlike a penetration test, a configuration review is a passive assessment — it identifies risk before exploitation occurs. This makes it ideal for environments where active testing is constrained, for newly deployed infrastructure before go-live, or as a complement to a VAPT engagement.
Why it matters
- Cloud provider research consistently shows that misconfiguration accounts for over 70% of cloud security incidents
- Default credentials on network devices are discovered by internet scanners within minutes of a device being connected
- Firewall rules accumulate over years without review — 'temporary' rules become permanent and overly permissive rules multiply
- OS hardening drift is invisible to most monitoring tools — a compliant baseline at deployment can become non-compliant within months
- Many compliance frameworks (PCI-DSS, ISO 27001, HIPAA) require documented configuration management and baseline compliance evidence
Our methodology
1. Baseline Selection & Scope Definition
Agreement on applicable baselines (CIS Level 1/2, vendor hardening guide, regulatory requirement) and in-scope asset types: firewalls, routers, switches, Windows/Linux servers, cloud environments, or application configurations.
2. Configuration Collection
Collection of configurations via read-only access — configuration exports, CIS-CAT scans, or manual extraction with no changes to production systems. We document exactly what we collected and how.
3. Baseline Comparison & Analysis
Systematic comparison of collected configurations against selected baselines. Every deviation is documented with risk rating, business justification check, and compensating control assessment.
4. Prioritised Findings & Remediation
Findings are prioritised by exploitability and potential impact. Remediation scripts or configuration snippets provided where applicable, with validation checks for your team to confirm remediation.
Frequently asked questions
Do you need privileged access to our systems?
Read-only privileged access is required to collect configuration data. We use the principle of least privilege — requesting only the access needed to export configuration data. We never modify configurations during a review engagement.
Which CIS Benchmark levels do you use?
By default, we test against CIS Level 1 (recommended for most environments). Level 2 is available but may include controls that impact performance or functionality — we discuss this with you before scoping. Our CIS Hardening service implements and verifies both levels.
Can you review our firewall rules even if we have thousands of them?
Yes. We use automated parsing tools supplemented by manual review of high-risk rule categories (any/any, management plane access, rules permitting traffic from external to internal). The volume doesn't prevent comprehensive review — it just affects the engagement duration.
How often should we run a configuration review?
Following any major infrastructure change, before and after cloud migrations, and at minimum annually. For PCI-DSS environments, quarterly reviews of critical systems are recommended by the standard.
Is this the same as a CIS Hardening engagement?
A Configuration Review assesses your current state against a baseline and identifies gaps. Our CIS Hardening service goes further — we implement the remediation, verify it, and provide hardening scripts. Think of Configuration Review as the audit and CIS Hardening as the remediation programme.
Deliverables
Baseline Gap Report
Full deviation list from selected CIS or vendor benchmark, with risk ratings per finding
Firewall Rule Analysis
Review of all firewall rules with risk-rated findings for overly permissive or shadowed rules
Network Device Configuration Report
Assessment of router/switch/VPN device configurations against hardening guides
Remediation Matrix
Prioritised remediation tasks ordered by risk severity and estimated implementation effort
Compliance Evidence Pack
Documentation suitable for auditor review against PCI-DSS, ISO 27001, or similar requirements
Industries served
Start your engagement
Talk to a certified operator about scoping a Configuration Review assessment for your environment.
Contact UsView Sample ReportRelated services
Ready to test your Configuration Review posture?
All engagements are led by certified operators with unlimited retests until every critical finding is resolved.