listing IPs on an internal network diagram for audit?

Posted by jpotrz@reddit | sysadmin | View on Reddit | 11 comments

We got dinged on an audit because the internal network diagram we provided did not include IP addresses. This is a newer client, and we've never had issues for other clients with our diagrams not listing IP addresses. It just seems like an unusual and fairly pointless thing to include? Or am I missing something here?

[-]

iceph03nix@reddit

What kind of audit?

I've never had any of our audits ever care about network diagrams like that.

That said, I feel like our auditors change what's important every year with no rhyme or reason

If it's just a client checking up on what you're doing for them, then I'd say you just make it how they like it, within reason, and move on.

[-]

Kardinal@reddit

Yeah I'd like to know what standard they are auditing against.

[-]

unixuser011@reddit

Some auditors can be a bit anal about what’s on the report and what’s not. I can understand about getting dinged because some Linux VM doesn’t have AV but listing all IPs? Never seen that before - but should be easy to satisfy, just do a quick nmap ping scan or use massscan

[-]

jpotrz@reddit (OP)

yeah I'm not worried about doing it. I, just like you have said, have never seen it before. Seems weird and I don't really understand what benefit it would be to them. "Oh you're DC is 1.100 and not 1.101? We approve of that"

And yeah, I'm all too familiar with anal auditors. Nothing but checkboxes for them to fill out and each year they have to add more checkboxes to make it seem like they are deepening their attentiveness or something.

[-]

singlejeff@reddit

Tell them InfoSec said no?

[-]

jpotrz@reddit (OP)

Small(er) shop. I am InfoSec 🤘

[-]

Nandulal@reddit

'anal auditors' HOLD ONTO YOUR BUTTS!

[-]

Adam_Kearn@reddit

Look into a tool called netdisco

You can set it up to constantly scan your network and find devices that you never knew existed on your network.

[-]