25 June 2020

Regular firewall rule assessments are basic IT/OT security housekeeping procedures. Security staff challenges every rule after well-known industry best practice like ANY Computer or ANY Port rules, bi-directional rules, use of unsecure protocols like ftp, telnet, smb, not used rules, etc.

Picture 1: Nervennahrung for firewall rule assessments

Compliance to industry best practice can be achieved with a plain checklist. Thus the check can be automated to a far extent. The nerve-racking work starts afterwards, when each finding is discussed with the users.

But, in general, the security staff does not challenge the rule itself. Or it’s direction. Or the ports used.

These questions are asked after the rule has passed the best practice checks. No automation possible. They require in-depth knowledge of the services accessed through the firewall, and, they belong to the nerve-racking category. But it’s worth to ask these questions because

The best firewall rule is the one that not exists.

You must not care of such rules in the case of a security incident, no regular review required, no discussion with users. Entrepreneurs should be interested in cleaning up the rule base because it saves costs, and increases security.

More about this in the next post.

Picture credits

Picture 1: Vienna 2020. Own work