Misconfigured firewalls

[Lance Spitzner <lance () ksni net>]

A trend I have noticed after auditing a variety of clients is
miconfigured firewalls.  I often find rules that expose my
clients to great risk, even though they spent $50,000 on their
firewall setup.  I've written a whitepaper to help firewall
admins build their first rulebase.  My goal is to give admins
a place to start in building a solid rulebase, hopefully 
avoiding the more common pitfalls of rulebase design.

I would greatly appreciate if you guru's out there could 
give the paper a "looksy" before I publish it.  I want to
be sure I'm giving firewall admins a good start.  Also, I 
would greatly appreciate any suggestions you may have based
on your experience with firewall rulebases.  I base my
examples on FW-1, but they should apply to most firewalls.

Designing Your Firewall Rulebase
http://www.enteract.com/~lspitz/rules.html

Thanks!

Lance Spitzner
http://www.enteract.com/~lspitz/papers.html