IT assessment
Firewall configuration hardening audit
We audit the rule sets and settings of your existing firewalls against accepted security recommendations and identify the parts that pose a risk.
Scope of the audit
What we look for in the rule set
In a rule set that has been growing for years, a large share of the rules is typically no longer needed. We look at the problems in four groups.
Unnecessary rules
Rules that no traffic matches, or that are shadowed by a broader rule placed above them, so they never take effect.
Overly permissive rules
Permissions that open up more sources, destinations, or services than needed. The benchmark is the principle of least privilege: anything not explicitly allowed is denied.
Outdated rules
Permissions that stayed in place after the environment changed. Typical examples are entries for decommissioned servers, closed projects, or former suppliers.
Weak settings
Gaps in the device's own configuration. These typically include who can reach the management interface, how administrator accounts are protected, logging, and how up to date the firmware is.
When you need it
When the rule set is no longer easy to follow
A rule set rarely goes bad all at once. In the situations below, it is worth having it reviewed.
Nobody knows why a rule is there
If the reason behind a rule gets lost, two years later no one dares to touch it, and from then on the rule set only grows.
Before a firewall replacement or migration
If the old rule set moves to the new device unchanged, the unnecessary and overly permissive rules go with it.
The environment has changed
After a new site opens, systems are retired, or applications move to the cloud, the rule set rarely keeps up with the change on its own.
Unused capabilities
Organizations typically use only a fraction of what the devices they have bought can do. The firewall can segment the network, but nobody has configured it to do so.
Deliverables
What you get at the end
items handed over
- Rule set analysis with a list of risky rules
- Configuration deviations from the recommendations
- Prioritized remediation recommendations
- Implementation of the fixes, if requested
Related services
When the audit leads further
The audit results often point beyond the firewall.
IT security assessment
If you want to know the state of your whole environment, not just the firewall.
Firewall and VPN
If you need a new device after the audit: design, installation, and configuration, VPN included.
Network segmentation
If it turns out that the network is flat and there is no decision point between segments.
Frequently asked questions
What people usually ask about the audit
How is this different from the IT security assessment?
The IT security assessment looks at the whole environment, from access management through backup to user security, and it also examines the network devices and the topology. The hardening audit deals only with the firewalls, but it goes through them rule by rule.
Can every rule that nothing uses be deleted?
Most firewalls show hit counts, and rules with zero hits can usually be deleted. A rule for a rarely run process or a backup connection, however, can go without hits for a long time, so the purpose of the rule has to be clarified before it is deleted. We also covered regular rule reviews in our article on segmenting the internal network.
Can the audit show that the firewall needs replacing?
Yes, but an overgrown rule set is rarely a reason on its own, because it can often be cleaned up without a replacement. A replacement is justified if vendor support has expired or will expire soon, if the hardware cannot handle inspection of encrypted traffic, or if the device only supports port-based rules and not application-level ones.
