Re: Auditing Firewalls

["Gleb Paharenko" <gpaharenko () gmail com>]

Hi, all.


> Also I want to know , As an IT Auditor, am i  supposed to have access to the FW ( eg. >Read only access to check the 
> rules /ACLs ) or shall I ask for a copy of these rules ?

It is the part of the common question - to have access to the system
you're testing or not to have. From my experience - I do not ask for
an access to production systems, especially, if I do not know them.
For deployed projects which are in  a testing phase, getting the
access usually improves the speed of tests in several time.


> I am not sure where to start from , and I wanted your advice especially those  who >conducted Auditing for FWs.

I'm not a network security (and even network specialist), however for
testing every system, you should get configuration information about
it, list of attack vectors against you will test it, back link to
check if attack was successful or to debug possible issues (access to
the system with super privilege is good for it).

> Our firewalls are in production, am I supposed to test them from different subnets ? >such as plugging my laptop to 
> the DMZ and run my tools ?

It is always good to test from every security zone. And you should
reduce intermediate factors which can influence on results (like IPS).




4 Dec 2007 21:56:00 -0000, ahgaber_rehan () yahoo com <ahgaber_rehan () yahoo com>:
> Hi,
>
> I just shifted to IT Audit field.
>
> I was wondering If there is any audit program can help me auditing my 2 Firewalls
>
> Fortigate NGX-R60 and  Sidewinder.
>
> I am not sure where to start from , and I wanted your advice especially those  who conducted Auditing for FWs.
>
> Our firewalls are in production, am I supposed to test them from different subnets ? such as plugging my laptop to 
> the DMZ and run my tools ?
>
> Of course you know testing FW's in productions moght not take effect if idid my test from the LAN or the internet  
> since there will be IPS which will reset my Scanner.
>
>
> Also I want to know , As an IT Auditor, am i  supposed to have access to the FW ( eg. Read only access to check the 
> rules /ACLs ) or shall I ask for a copy of these rules ?
>
>  I mean is there a standard being followed and what can help me get good observations.
>
>
> regards.
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE today!
>
> http://www.cenzic.com/downloads
> ------------------------------------------------------------------------


-- 
Best regards.
Gleb Pakharenko.
http://gpaharenko.livejournal.com

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------