Rules Assurance: Preventing Unauthorized Access through Building Right Firewall Configuration

Abstract

Any business organization’s backbone is their infrastructure which establishes the connection between their own intranet, vendor/customer network and external world. Network is linked between these network are through dedicated connection or public connection via internet. To build any network, it requires servers, firewalls, routers, core and access switches with communication link. The topology of network, link type, usage of network devices are chosen based on organization need and type of data transaction flows between these networks. Considering volume of data growth because of digital revolution, sensitiveness of data like Personally Identifiable Information (PII) or Protected Health information (PHI), it is necessary to protect data from hackers and save network from phishing, malware or ransomeware. Firewall will control the access and decides what to allow or deny between networks. These rules are defined in firewall Access Control List (ACL). A strong, well matured access control policy plays a key role to ensure network security and data protection. A firewall rule defines inbound and outbound data traffic between source and destination. These sources and destinations are identified by IP addresses, subnet ranges, protocols, applications, and port numbers. ACL defines what can be accessed / denied from internal (OUT BOUND) or from external (IN BOUND). In general a firewall has hundreds of ACLs and at times in thousands as well. Since frequent changes are inevitable, managing firewall rules becomes a complex task. There is no relationship between these rules and need not be in an order. Firewall will not validate duplicate or overlapping of rules. Every rule in ACL is independent and there are more possibilities of having obsolete and invalid rules. To overcome all these complexities, this wok presents rules mining, which helps to analyze firewall rules, identify security flaws, vulnerabilities from existing rules and eliminate redundant or unused rules from network. This paper proposes a new guidelines that can be used on existing firewall ACL or while building new firewall ACL to protect network from external sources. These guidelines will help network administrators to fix configuration errors.