Skip to content
Penetration testing
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
All services on one page
Industries How we work About Blog
1300 AURIAN Contact
Menu
Penetration testing
  • Penetration testing services
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Security assurance and compliance services
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Managed security services
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
  • All services
  • Industries
  • How we work
  • About
  • Blog
Call 1300 AURIAN Contact
  1. Services
  2. Security assurance
  3. Configuration review and benchmarking

Security assurance

Configuration review and benchmarking

We review the configuration of the systems that matter against recognised benchmarks, and hand you the exact settings to change.

Scope a test Call 1300 AURIAN

Who this is for

  • You want to know your systems are hardened, not just patched

    Patching closes known holes; configuration decides how much damage a foothold can do. The defaults are rarely the safe choice.

  • A firewall rule base has grown for years

    Rules accumulate and rarely get removed. A review finds the permissive, redundant and shadowed rules that widen your exposure.

  • An audit or framework asks for benchmarked configuration

    Standards and insurers ask whether systems are configured to a recognised baseline, and you want an independent, evidenced answer.

What our configuration review covers

Internet Web application API Perimeter Cloud tenancy Email Office network Workstation Identity Wireless Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. API: NOT IN SCOPE HERE Covered by API penetration testing. Click to open that service. PERIMETER: CHECKS INCLUDE Firewall rule-base review Remote access and VPN configuration Management plane exposure CLOUD TENANCY: CHECKS INCLUDE Microsoft 365 and Entra tenancy configuration Conditional Access, mail flow and sharing settings EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: CHECKS INCLUDE The standard operating environment against CIS Benchmarks Local administrator, macro and browser settings IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. CROWN JEWELS: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. SERVERS: CHECKS INCLUDE Servers and network devices against CIS Benchmarks Logging, time and administrative access settings Internet Web application Perimeter API Email Cloud tenancy Office network Workstation Wireless Identity Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. PERIMETER: CHECKS INCLUDE Firewall rule-base review Remote access and VPN configuration Management plane exposure API: NOT IN SCOPE HERE Covered by API penetration testing. Click to open that service. EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: CHECKS INCLUDE Microsoft 365 and Entra tenancy configuration Conditional Access, mail flow and sharing settings OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: CHECKS INCLUDE The standard operating environment against CIS Benchmarks Local administrator, macro and browser settings WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. CROWN JEWELS: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. SERVERS: CHECKS INCLUDE Servers and network devices against CIS Benchmarks Logging, time and administrative access settings

We review the configuration of the systems you nominate against the CIS Benchmarks and vendor guidance, and report every deviation with the exact change to make.

  • Firewall rule-base review, including permissive, redundant and shadowed rules
  • Server operating system configuration, Windows and Linux, against the benchmarks
  • The standard operating environment for endpoints
  • Network device configuration, covering switches, routers and wireless controllers
  • Microsoft 365 and Entra ID tenancy configuration
  • Hypervisor and virtualisation platform hardening
  • Logging, monitoring and time synchronisation across the estate
  • Administrative access, service accounts and default credentials

How we test it

Patching closes the holes an attacker already knows about. Configuration decides how much an attacker can do once they are past the perimeter, and it is where secure-by-design products quietly become insecure through defaults, accumulated exceptions and settings nobody has revisited. An Aurian configuration review measures the systems that matter to you against the CIS Benchmarks and the vendors’ own hardening guidance, and returns the exact settings to change.

This is manual work. A consultant reviews each system’s configuration by hand against the relevant benchmark, because judgement is what separates a deviation that matters from one that does not. A firewall rule base is the clearest example: automated tools can list the rules, but it takes a person to see that rule 900 permits everything outbound, that three rules above it are now shadowed and dead, and that the whole base could be a third of its size. We report deviations ranked by the risk they carry, not as a flat checklist, so the report leads with the settings worth changing first.

The review covers whatever you nominate: firewalls and network devices, Windows and Linux servers, the standard operating environment, the Microsoft 365 tenancy and the virtualisation platform. For each finding you receive the precise change to make, mapped to the benchmark it comes from, so your engineers can act without a second conversation. Where you want help applying the changes, our remediation support service can carry them through and retest the result.

Standards CIS Benchmarks, NIST SP 800-53, Vendor hardening guides

  1. 01 Scoping

    We agree the systems in scope and the benchmark for each, and arrange the read access and configuration exports we need.

  2. 02 Review

    A consultant reviews each system's configuration by hand against the benchmark and vendor guidance, judging real risk rather than counting deviations.

  3. 03 Prioritisation

    We rank deviations by the risk they carry, so the report leads with the settings that matter rather than a flat checklist.

  4. 04 Reporting and retest

    You receive the exact settings to change. Once you have remediated, a retest of the high-risk deviations confirms what is closed and the report is updated. Retesting is quoted with the review or booked afterwards.

What you receive

Every finding in an Aurian report looks like this: what we found, the evidence, what it means for you, and what to change.

Moderate AUR-2026-014 Sample finding, fictional environment

Firewall permits any-to-any outbound, defeating egress control

Affected asset
Perimeter firewall, internal to internet rule base
Rating
Moderate Possible 3 × Medium 3 = 9

Description

The firewall permits all outbound traffic from the internal network to the internet on any port. There is no egress filtering, so a compromised host can reach any command-and-control server and exfiltrate data over any protocol, and the permissive rule masks what legitimate traffic actually requires.

Evidence

# rule 900 (last in chain)
from  LAN_ANY
to    INTERNET_ANY
service ANY
action ALLOW
log   disabled
# no restriction on destination, port, or protocol; no logging

A single any-to-any allow rule at the end of the chain, with logging off, permits and hides all outbound traffic.

Impact

Egress filtering is one of the most effective controls against data theft and malware command-and-control, and here it is absent. A compromised workstation can send data anywhere over any port with nothing to block or record it, which turns a contained incident into a breach and leaves no trail to investigate.

Remediation

Replace the any-to-any rule with an allow-list of the destinations and ports the business actually needs, default-deny the rest, and enable logging on the egress rules. Review outbound requirements per network segment, and alert on denied egress as an early sign of compromise.

References

  • CIS Benchmarks for network devices
  • ASD, implementing network segmentation and segregation
  • Executive summary with the overall posture and the highest-risk deviations
  • A finding for each deviation, ranked by risk, with the exact setting to change
  • Mapping to the CIS Benchmark or vendor guidance used for each system
  • Remediation guidance your own engineers can apply without calling us

Common findings

What this kind of engagement typically surfaces, so you can recognise your own environment.

  • Permissive firewall rules

    Any-to-any rules, redundant and shadowed rules, and rules that outlived the systems they were written for.

  • Missing egress filtering

    Unrestricted outbound traffic that lets malware call home and data leave over any protocol.

  • Insecure defaults left in place

    Default credentials, sample content and unnecessary services enabled on servers and network devices.

  • Weak administrative access

    Shared administrator accounts, no separation of privileged and daily-use accounts, and management interfaces exposed too widely.

  • Inconsistent logging

    Logging disabled or inconsistent across systems, and clocks that are not synchronised, so events cannot be correlated.

  • Unhardened Microsoft 365

    Legacy authentication enabled, over-broad sharing, and administrative roles assigned more widely than needed.

Frequently asked questions

How is this different from a penetration test?

A penetration test shows what an attacker can do; a configuration review shows how each system differs from a hardened baseline. A test finds the path in, a review finds the weak settings that made the path possible and the ones that have not been used yet. Many organisations run both.

Do you need administrative access?

Usually read access is enough: a read-only administrator or auditor role, and the ability to export configurations. We tell you exactly what we need per system at scoping, and we never make changes ourselves.

Which benchmark do you use?

The CIS Benchmark for the system where one exists, supported by the vendor's own hardening guidance and NIST SP 800-53 where a client reports against a NIST-based framework. We name the benchmark used for each system in the report.

Can you review just our firewalls?

Yes. A firewall rule-base review is a common standalone engagement, because rule bases grow for years and rarely get pruned. We can scope the review to whichever systems matter most to you.

How long does it take?

It depends on the number and type of systems in scope: typically three to five days of review, with the report following. We confirm the timeframe after scoping.

Related services

Essential Eight assessment

Essential Eight assessment against the ASD maturity model: every strategy tested with evidence, rated ML0 to ML3, with a prioritised uplift roadmap.

Cloud security assessment

Cloud security assessment for AWS, Azure, Microsoft 365 and Google Cloud: CIS Benchmark review and attack-path testing of identity, exposure and logging.

Remediation support and retesting

Penetration test remediation support and retesting: hands-on help closing findings, sessions with your engineers or MSP, and a formal retest and report.

Security assurance and compliance services

Scope a test with a senior consultant

Tell us what you need to know about your environment. We reply within one business day.

Scope a test Call 1300 AURIAN

Aurian Security is an Australian penetration testing and security assurance firm. Senior consultants perform every engagement, for clients across the country.

Penetration testing

  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation

Assurance and managed

  • Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
  • Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring

Company

  • About Aurian
  • How we work
  • Industries
  • Blog
  • Contact
  • Privacy policy
526/368 Sussex St, Sydney NSW 2000 1300 AURIAN (1300 287 426) sales@aurian.com.au

© 2026 Aurian Security Pty Ltd. ACN 639 930 528.

This site is static, loads no third-party trackers, and publishes a security.txt.