Re: Auditing a firewall rulebase

["Paul Melson" <pmelson () gmail com>]

> Rules which have "any" or an equivalent keyword in them 
> Rules where an entire subnet has been granted access to a resource 
> Rules where a range of IP addresses has been granted access to a resource 
> Rules where a large range of ports has been opened to an IP Address /
Addresses 
> Rules where there are design issues in the protocol itself eg. Unencrypted
traffic
> Rules which are redundant and can be removed from the rulebase

That's a pretty good list, actually.  I would add; rules that allow access
to the firewall.  You will also want to audit for what kind of logging is
turned on/off and whether or not that poses a risk.  Also think in terms of
implied rules (like interface security levels in a PIX or Global Policy in
Check Point) and whether or not those create any of the situations you
mention above.

PaulM

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards