Direct answer
Choose test vantage points to reflect the questions being asked: an external internet position, an authorized internal network or a remote user can see different services. Record the source, credentials and network path for each observation.
Write the question first
An external review may ask which owned services are reachable from the internet. An internal review might ask whether a normal office user can reach a management segment. A VPN user's path can differ from both; each requires its own authorized starting point.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Record the network context
Document the tester's source address or network, VPN state, DNS context, identity and assessment time. A blocked connection from one location does not prove the same port is blocked from another. Conversely, a successful connection does not by itself prove a vulnerability.
- Name in-scope ranges for each vantage point.
- Identify segmentation, gateways and permitted accounts.
- Record unavailable paths and test windows.
Compare intended and observed paths
For a management interface intended for the support subnet, compare an authorized support path with a separate non-support test path. Record the source and observed behavior for both. A single negative result is incomplete if the approved support path was never checked.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Report coverage and retest
Include tested sources and exclusions with each network finding. After a firewall change, repeat relevant allowed and denied checks from comparable locations and note any different routing or device identity. Coordinate tests so they do not disrupt normal administration.
Assessment limits
A point-in-time test from selected networks cannot establish reachability from all locations or account for future routing and policy changes.
Frequently asked questions
Does an external test cover the internal network?
No. It only observes the external starting point and agreed paths. Internal testing requires separate access and scope.
Does an open port prove a service is exploitable?
No. Identify the service, intended clients, configuration and evidence before claiming a vulnerability.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.