Firewall review: the rules that stayed
A firewall running for five years carries five years of temporary rules. A port opened for a supplier who is gone, an exception for a system that was switched off, a rule with a comment nobody understands any more. A review takes that out and shows what is actually open.
Four things that almost always come out
None of the four raises an error, and all four are open.
- Rules that no longer do anythingReferences to addresses and systems that no longer exist. They are harmless and make the list unreadable, so the rules that do matter stop standing out.
- Rules that are too wideAccess to a whole network where one server was meant, or from anywhere where one office was meant. This is the category that during an incident makes the difference between one system and all of them.
- Management reachable from outsideThe firewall’s own management screen, or an outdated VPN entrance. This is one of the most used ways in and it can be closed with a single rule.
- Software behind on updatesThe firewall is the device whose flaws are exploited fastest and which is hardest to reboot. Falling behind here is the most expensive backlog there is.
How such a review runs
Three steps, without anything dropping out.
Read out and compare
The configuration is read out and set against the manufacturer’s common baselines. That happens without changes: nothing drops out.
Discuss what can go
Every rule that could be removed is walked through with somebody who knows the network. A rule that looks nonsensical sometimes turns out to be the reason payroll runs.
Clean up outside office hours
The changes go on in one pass, with a way back. Afterwards there is a list of what was removed and why, so it can be read back in three years.
What belongs with this
The firewall is the border; what stands behind it belongs to this too.
Know what is actually open
Tell us which brand of firewall is installed and how long it has been there. You get a review with a list sorted on risk, and a proposal for the clean-up.
Practical IT knowledge in your inbox
New guides on management, security and the workplace, written by the people doing the work. No sales talk, and you can unsubscribe in one click.