NetApp Security Assessment

Technical Findings Report

Cluster Name:	sample-cluster	Analysis Date:	January 09, 2026 at 04:30 PM
ONTAP Version:	9.16.1P10	Node Count:	2
Total Findings:	324	Security Grade:	Grade D (62)

Findings Summary

Severity	Count	Description
CRITICAL	0	Requires immediate action - significant security risk
HIGH	127	High priority - remediate within 48-72 hours
MEDIUM	27	Schedule remediation during planned maintenance
LOW	4	Address during regular maintenance cycles
PASSED	166	Security control meets requirements

NIST CSF 2.0 Coverage

Function	Total	Issues	Passed	Description
Identify	11	1	10	Asset management and risk assessment
Protect	205	90	115	Safeguards to ensure service delivery
Detect	49	36	13	Timely discovery of cybersecurity events

Detailed Findings & Remediation

CIFS Security

30 findings: 2 high | 9 medium | 3 low | 16 passed

Description: The LM compatibility level allows legacy LM and/or NTLMv1 authentication methods. LM (LAN Manager) hashes are cryptographically weak and can be cracked in seconds. NTLMv1 is also vulnerable to relay attacks and offline cracking. Modern environments should use NTLMv2 or Kerberos only.

NIST CSF 2.0: Protect | Data Security | PR.DS-2

Remediation:

Restrict authentication to NTLMv2 and Kerberos only:

1. Set LM compatibility level to Kerberos only (most secure):
   vserver cifs security modify -vserver <vserver> -lm-compatibility-level krb

2. Or allow NTLMv2 and Kerberos (if legacy clients require NTLM):
   vserver cifs security modify -vserver <vserver> -lm-compatibility-level ntlmv2-krb

3. Verify the configuration:
   vserver cifs security show -vserver <vserver> -fields lm-compatibility-level

Affected Items:

Severity	Context	Value
HIGH	Vserver: sample-prod-nfs	lm-ntlm-ntlmv2-krb
HIGH	Vserver: sample-mgmt	lm-ntlm-ntlmv2-krb
MEDIUM	Vserver: sample-smb	false
PASSED	Vserver: sample-smb	krb

Cluster and Vserver Access Policy

27 findings: 27 high

Description: This network service policy allows connections from any IP address (0.0.0.0/0) for management services. This exposes administrative interfaces (SSH, HTTPS, HTTP) to potential unauthorized access from any network location, significantly increasing the attack surface.

NIST CSF 2.0: Protect | Access Control | PR.AC-3

Remediation:

Restrict management access to specific trusted networks:

1. Identify legitimate management networks/hosts

2. Modify the service policy to restrict access:
   network interface service-policy modify-service -vserver <vserver> \
     -policy <policy> -service <service> -allowed-addresses "<trusted-subnet>/24"

3. For cluster-level management:
   network interface service-policy modify-service -vserver <cluster> \
     -policy default-management -service management-https \
     -allowed-addresses "10.0.1.0/24,10.0.2.0/24"

4. Verify the configuration:
   network interface service-policy show -vserver <vserver> -policy <policy>

Best Practice: Restrict to specific management VLANs or jump host IP addresses.

Affected Items (showing first 6 of 27):

Severity	Context	Value
HIGH	Vserver: sample-nfs-02 Policy: default-management Service: management-http	0.0.0.0/0
HIGH	Vserver: sample-nfs-02 Policy: default-management Service: management-https	0.0.0.0/0
HIGH	Vserver: sample-nfs-02 Policy: default-management Service: management-ssh	0.0.0.0/0
HIGH	Vserver: sample-smb Policy: default-management Service: management-http	0.0.0.0/0
HIGH	Vserver: sample-smb Policy: default-management Service: management-https	0.0.0.0/0
HIGH	Vserver: sample-smb Policy: default-management Service: management-ssh	0.0.0.0/0

... and 21 more findings in this category

📊 Full Report Includes 18 Security Categories

This sample shows 2 of 18 security categories analyzed. The full technical report includes detailed remediation steps with copy-paste CLI commands for all 324 findings across categories including:

Multi-Admin Verification • NFS Export Security • Volume Snapshots • Certificate Management • Ransomware Protection • User Profiles • VSCAN Status • Aggregate Encryption • And more...

FIPS Configuration

1 findings: 1 passed

Description: FIPS 140-2 compliance mode is properly enabled. All cryptographic operations use NIST-validated algorithms including AES and SHA-256. TLS communications use only FIPS-approved cipher suites, protecting data integrity and confidentiality.

NIST CSF 2.0: Protect | Data Security | PR.DS-1

Severity	Context	Value
PASSED	Cluster: sample-cluster	true