Bonus Question: Are network perimeter defenses (firewalls, proxies, WAFs) layered and centrally managed?

Why This Matters

Layered perimeter controls reduce exposure to attacks and provide unified visibility. Centralized management ensures policy consistency and faster response to threats.

Maturity

0 — Unaware
No defined perimeter or control layering.

1 — Ad Hoc
Independent firewall devices without standard rules.

2 — Defined
Multiple perimeter controls (FW, WAF, proxy) documented.

3 — Managed
Central management and rule synchronization implemented.

4 — Integrated
SIEM and SOC monitoring established across all layers.

5 — Optimized
Adaptive perimeter controls with automated threat feed updates.

How to Level Up

| From → To | Actions | |—|—| | 0 → 1 |Identify all perimeter devices and configurations.| | 1 → 2 |Document control layers and coverage.| | 2 → 3 |Implement centralized management console.| | 3 → 4 |Integrate logs with SIEM and SOC dashboards.| | 4 → 5 |Automate rule updates and dynamic blocking feeds.|

Enablers

People: Network Security Engineer, SOC Analyst
Process: Change management, log correlation
Technology: Firewalls, WAF, proxy gateways, SIEM

Evidence

Network perimeter diagram
Change-control and rule review logs
Centralized policy management screenshots

KPIs

Number of perimeter devices under central control
Percentage of perimeter rules reviewed quarterly
Mean time to update global policies

Low-Cost / Open-Source Options (MSME)

Common Pitfalls

Inconsistent firewall and WAF rules
Manual updates causing drift
Gaps in east-west visibility

Compliance Mapping