NETWORK MAPPING SUMMARY This component allows the auditor to identify the devices on a host's network, the services that are being used by those devices, and any protections in place. PURPOSE Mapping an organization's network exposes the multitude of devices connected to it -including mostly forgotten servers -- and provides the baseline for later work on device assessment and vulnerability research. This process also reveals outside service usage (such as google services, dropbox, or others) which serve -- intentionally or not -- as shadow infrastructure for the organization. In combination with beacon research from the network discovery process, many devices can be associated with users. THE FLOW OF INFORMATION Information Threats Results Threats Activity Actors Actors Capacity Capacity Activities Activities Barriers Barriers Assets Assets Vulnerabilities Vulnerabilities Network Mapping Information Flow GUIDING QUESTIONS What operating systems, and services being hosted or used by an organization? Are any hosts running unusual, custom, or outdated operating systems and services? Are there unexpected/unusual devices or services on the network? What is the topology of the network? What are the routers and modems managing it? What services (e.g. dropbox, web-mail, etc.) are running on the network that have not been mentioned by the organizational staff? What network assets does an attacker have access to once they have gained access to the internal network? APPROACHES Network Mapping: Map hosts, services, and network hardware by scanning network devices. Monitor Open Wireless Traffic: Monitor wireless traffic for handshakes, beacons, and MAC addresses. Wireless Range Mapping: Map the range of the organizations wireless network outside of office space. Page 54 of 240