A study published in this month’s ISSA Journal presents an analysis of firewall management practices. The authors surveyed 260 firewall administrators and supervisors. The results show that corporate firewall rulebases are unmanageably large and getting bigger, the administrators responsible for them know they’re riddled with errors, and they can’t fix the problems because they lack adequate tools.

Based upon the results of this study, we draw three conclusions:

Firewall rulebase complexity greatly exceeds that discovered in prior research and that administrators feel this complexity is a major contributing factor to rulebase configuration errors.

Evidence exists that administrators make errors on a routine basis and most consider it likely that their rulebases contain undetected errors that expose their organization to risk.

In general, firewall administrators are not following recognized best practices for firewall administration on a regular basis.

[...]

Seven years prior to our study, Wool conducted an analysis of Checkpoint firewall rulebases and discovered an average rulebase size of 144. Our results showed a dramatically higher average of 793 rules per firewall. Our sample included seven rulebases containing a significantly higher number of rules than the maximum size discovered in Wool’s study (our maximum size was 17,000, while Wool’s was 2,671).

[...]

In addition to measuring the size of rulebases, we measured the rate of change in rulebases as an indicator of the stability of the ruleset. We used rulebase churn to evaluate the change rate (ψ) relative to the overall rulebase size…. The average churn rate of 9.9% indicates that the
average firewall administrator modifies one-tenth of his or her firewall rulebase on a monthly basis. This large degree of turnover in the system introduces a high likelihood of error.

Coincidentally, Secure Passage today published the results of a survey of 253 IT network, firewall and security executives from Fortune 1000 companies.

The survey revealed that poor firewall management practices lead to security gaps, compliance violations, substandard firewall performance, and premature device purchases. The survey also revealed that although organizations are experiencing more compliance and security challenges due to increasing firewall policy complexity, few know about solutions or have access to resources that can address these challenges.

Among the top administration problems identified by the firewall administrators were rules allowing more ports or IPs than required by best practices, redundant rules, failure to identify and clean up unneeded rules, and absence of any review of the rulesets. Using a firewall analysis tool like Athena FirePAC can solve many of these issues. Finding redundant rules or shadowed rules is a snap with its Rule Conflicts report and the Culprit Rules report will call out problematic rules failing to meet best practices. In the face of today’s mind-bogglingly complex rulesets, FirePAC really helps the firewall administrator understand what’s going on inside the firewall.

Last Thursday we moved into our new corporate global headquarters, located in beautiful Lombard, Illinois. We’re still settling in amidst stacks of packing containers and piles of electronic equipment, finding our new routines. The transition went smoothly for the most part. There was only one casualty. Our venerable primary firewall suffered a massive hardware failure, finally giving up the ghost after many years of flawless service. Thanks to our crack technical team, a replacement was working in a few hours and we were able to minimize our downtime.

Here is our new contact information:

Athena Security, Inc.
1 East 22nd Street, Suite 107
Lombard, IL 60148
Tel. 630-629-0600
Fax. 630-629-2429