What does this network security infrastructure assessment cover?

The assessment covers eight domains: identity, access and network admission control (PAM, JIT privilege, NAC, cloud IAM); edge security, SASE and secure browser (SD-WAN, SSE, browser isolation, BYOD); Zero Trust architecture (ZTNA, micro-segmentation, identity-aware policy); WAN and private connectivity security (encrypted transport, MACsec on dark fiber and lambdas, failover integrity); availability and security resilience (DDoS protection, failure-mode policy enforcement, recovery time); threat detection and security observability (NDR, lateral movement detection, policy-versus-reality gap); cross-silo visibility and unified operations (single pane of glass across network, security, cloud, and application teams); and infrastructure lifecycle, IaC, and configuration hygiene (firmware currency, EOL tracking, IaC adoption, configuration drift detection).

How is the assessment scored?

Each of the 26 questions is scored on a 0-to-3 scale: 0 for no control or significant exposure, 1 for partial or inconsistent control, 2 for a functional but incomplete implementation, and 3 for a mature, fully implemented control. Domain scores are calculated as a percentage of maximum possible points and rated Strong (67% or above), Developing (34-66%), or Gap (below 34%). The overall score is an aggregate across all eight domains.

What is the difference between a Gap and a Developing rating?

A Gap rating means the domain has critical missing controls that create immediate, material exposure — typically scored below 34% of maximum points. A Developing rating means foundational controls exist but coverage is incomplete, inconsistent, or relies on manual processes that create blind spots. Both ratings generate specific gap narrative in the full report, but Gap-rated domains represent the highest-priority remediation targets.

What is MACsec and why is it included in the WAN domain?

MACsec (IEEE 802.1AE) is a Layer 2 encryption standard that encrypts traffic on physical network links before it enters the wire. Organizations running dark fiber, leased lambdas, or private wavelength connections often rely on physical isolation as a security control — but physical isolation is not a cryptographic guarantee. MACsec closes this gap by encrypting traffic at the hardware level on the link itself, ensuring that even if the physical medium is compromised, traffic cannot be read in transit. It is distinct from IPsec (which operates at Layer 3) and is particularly relevant for high-bandwidth private interconnects between data centers or campuses.

What is just-in-time (JIT) privileged access and how does it differ from a PAM vault?

A traditional PAM vault stores privileged credentials and requires users to check them out for use, but the credentials themselves are permanent — they exist continuously even when not in use. Just-in-time (JIT) access takes a different approach: privilege is created only when it is needed, scoped to the minimum required, and expires automatically after a defined window. There are no standing credentials to steal or misuse. JIT access, as implemented by platforms like Britive for cloud infrastructure, eliminates the concept of persistent privilege entirely for cloud console and API access.

What does cross-silo visibility mean in the context of network security?

Most organizations have separate teams and tools for network operations, information security, WAN management, cloud infrastructure, and application performance. A single incident — a performance degradation, a security event, or an infrastructure failure — often touches all of these layers simultaneously, but each team is looking at different data in different tools. Cross-silo visibility refers to the ability to correlate telemetry from all of these domains in a unified operational plane so that the right person can access the right data without depending on another team's tooling. Platforms like Arista CloudVision, NetMagus, and Catchpoint address different parts of this problem.

How does Infrastructure as Code (IaC) relate to security?

When network infrastructure is configured manually through CLI or GUI, configurations drift over time as engineers make ad hoc changes. This drift creates a growing gap between the intended security posture and what is actually running in production — a gap that is rarely visible until an audit or a breach. Infrastructure as Code (IaC) treats configuration as version-controlled, peer-reviewed source code. Every intended state is declared in code (Terraform, Ansible, Arista CloudVision configuration templates), every change is tracked, and drift from the declared state can be detected and alerted automatically. This makes security policy verifiable and auditable rather than assumed.

Skip to content

Solutions
Services
Software
About Us
Blog
Search

Solutions
Services
Software
About Us
Blog
Search

Security Infrastructure Assessment

Network Security Infrastructure Assessment

How Exposed Is Your
Infrastructure, Really?

26 questions across 8 domains. Get a scored baseline of your security posture with gaps mapped to the right architectures and tools, not a generic checklist.

8 domains

26 questions

~12 minutes

Instant scored results

223 S West St. Ste 900 Raleigh, NC 27601

Phone: (866) 840-5456

Privacy Policy

How Exposed Is YourInfrastructure, Really?

How Exposed Is Your
Infrastructure, Really?