ConfGoOne
Notes on the frameworks, attack paths, and real CVEs behind network and system config audits — from the team building ConfGoOne.
Reports from different tools overlap, contradict each other and miss things. Checking every finding against the device's own configuration turns them into one short, defensible list.
Read post →A practical checklist for auditing a Cisco IOS / IOS XE configuration: management access, authentication, SNMP, logging, NTP and unused services — with the commands to check and fix each one.
Read post →From any-any rules to exposed admin interfaces and missing logs: the firewall configuration mistakes that show up in almost every audit, why they matter, and how to fix them.
Read post →The obvious stuff — password complexity, NTP, banners — gets checked every time. These ten don't, and they're where real compromises start.
Read post →One misconfigured feature, one unauthenticated privilege-escalation bug, and tens of thousands of routers with a planted admin account. Here's what a config audit would have — and wouldn't have — caught.
Read post →A device can pass its audit on Monday and be wide open by Friday, with nobody touching the audit report in between. Point-in-time scans can't see that. Here's what can.
Read post →A list of 40 findings sorted by severity tells you what's wrong. It doesn't tell you which three of them, chained together, get an attacker to domain admin. That's a different question.
Read post →Three frameworks, three different jobs. If you've ever had to explain to an auditor why "we're NIST-aligned" doesn't mean "we're PCI-compliant," this is for you.
Read post →