| name | Network Security Architecture Validator |
| slug | security-network-validator |
| description | Validate network security architecture with firewall rule analysis, segmentation verification, and defense-in-depth assessment. |
| capabilities | ["Firewall rule documentation and default-deny validation","Network segmentation review (DMZ, internal zones)","VPN and encrypted transit verification","Intrusion Prevention System (IPS) coverage","Micro-segmentation for east-west traffic"] |
| inputs | [{"network_identifier":"Network or environment identifier (string, required)"},{"architecture_scope":"perimeter | internal | vpn | all (string, default: all)"},{"segmentation_model":"dmz | zero-trust | hybrid (string, optional)"}] |
| outputs | [{"findings":"JSON array of network security findings with control references"},{"segmentation_analysis":"Network zone isolation assessment"},{"remediation_rules":"Firewall rule or network policy configurations"}] |
| keywords | ["network-security","firewall","segmentation","dmz","vpn","ips","micro-segmentation","defense-in-depth"] |
| version | 1.0.0 |
| owner | cognitive-toolworks |
| license | MIT |
| security | Public; no secrets or PII; safe for open repositories |
| links | ["https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final","https://www.cisecurity.org/controls"] |
Purpose & When-To-Use
Trigger conditions:
- Network security architecture review before production deployment
- Network segmentation validation
- Firewall rule audit
- VPN security assessment
- Post-incident network security review
Not for:
- Real-time intrusion detection (use IDS/IPS tools)
- Network performance optimization (use network monitoring tools)
- Cloud network security (use security-cloud-analyzer)
- Application-level security (use security-appsec-validator)
Pre-Checks
Time normalization:
- Compute
NOW_ET using NIST/time.gov semantics (America/New_York, ISO-8601): 2025-10-26T01:33:55-04:00
- Use
NOW_ET for all citation access dates
Input validation:
network_identifier must be non-empty stringarchitecture_scope must be one of: [perimeter, internal, vpn, all]segmentation_model must be one of: [dmz, zero-trust, hybrid] or omitted
Source freshness:
Procedure
Step 1: Critical Network Security Controls Check
Perimeter Security:
- Firewall rules documented and reviewed (NIST SP 800-53 SC-7, accessed 2025-10-26T01:33:55-04:00)
- Default-deny firewall stance (explicit allow-list only)
- No overly permissive rules (0.0.0.0/0 ingress on sensitive ports)
- DMZ zone for internet-facing services
Internal Segmentation:
- Network zones defined (production, staging, management, user)
- Inter-zone traffic restrictions (east-west segmentation)
- Micro-segmentation for critical assets
- Broadcast domain isolation
Encrypted Transit:
- VPN for remote access (IPsec or WireGuard)
- TLS/SSL for sensitive data in transit
- No cleartext protocols on sensitive networks (FTP, Telnet, HTTP)
Monitoring and Detection:
- Network flow logging enabled
- Intrusion Prevention System (IPS) deployed
- DDoS protection mechanisms
Step 2: Generate Remediation Rules
For each finding, provide:
- NIST SP 800-53 control reference (SC family)
- Firewall rule syntax (iptables, pf, cloud security groups)
- Network policy configuration (Kubernetes NetworkPolicy, Cisco ACL)
Token budgets:
- T1: ≤2k tokens (critical network security findings)
- T2: ≤6k tokens (full network architecture audit)
- T3: Not applicable for this skill (use security-auditor agent for comprehensive assessments)
Decision Rules
Ambiguity thresholds:
- If network diagram unavailable → request architecture documentation
- If firewall rules inaccessible → assess based on observed traffic patterns
Abort conditions:
- No network identifier specified → cannot proceed
- No firewall rules or network policies accessible → limited to high-level assessment
Severity classification:
- Critical: Default-allow firewall, no segmentation (CVSS 9.0-10.0)
- High: Overpermissive rules, missing VPN encryption (CVSS 7.0-8.9)
- Medium: Logging gaps, weak segmentation (CVSS 4.0-6.9)
- Low: Documentation gaps, rule optimization (CVSS 0.1-3.9)
Output Contract
Required fields:
{
"network_identifier": "string",
"architecture_scope": "perimeter|internal|vpn|all",
"segmentation_model": "dmz|zero-trust|hybrid or null",
"timestamp": "ISO-8601 with timezone",
"findings": [
{
"id": "unique identifier",
"category": "firewall|segmentation|vpn|monitoring",
"severity": "critical|high|medium|low",
"cvss_score": 0.0,
"title": "brief description",
"description": "detailed finding",
"nist_control": "SC-7 or similar",
"affected_zones": ["network zones or segments"],
"remediation": "specific fix steps",
"remediation_rule": "firewall rule or policy config"
}
],
"segmentation_analysis": {
"zones_defined": ["list of network zones"],
"isolation_score": "0-100 (100=perfect isolation)",
"gaps": ["list of segmentation gaps"]
},
"summary": {
"total_findings": 0,
"critical_count": 0,
"high_count": 0,
"overall_risk": "critical|high|medium|low"
}
}
Examples
Example: Firewall Rule Audit
network_identifier: "production-network"
architecture_scope: "perimeter"
segmentation_model: "dmz"
{
"network_identifier": "production-network",
"findings": [
{
"id": "NET-001",
"category": "firewall",
"severity": "high",
"cvss_score": 7.5,
"title": "Overly permissive SSH ingress rule",
"nist_control": "SC-7(5)",
"remediation_rule": "iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT"
}
],
"summary": {"high_count": 1, "overall_risk": "high"}
}
Quality Gates
Token budgets:
- T1 ≤2k tokens (critical network security findings)
- T2 ≤6k tokens (full network architecture audit)
Safety:
- No actual IP addresses in public examples
- No sensitive network topology details
Auditability:
- Findings cite NIST SP 800-53 SC controls
- Firewall rules follow security best practices
Determinism:
- Same network state + inputs = consistent findings
Resources
NIST Standards:
CIS Controls:
Network Security Best Practices:
