Offline firewall analysis

Abstract

Practically every corporation that is connected to the Internet has at least one firewall, and often many more. However, the protection that these firewalls provide is only as good as the policy they are configured to implement. Therefore, testing, auditing, or reverse-engineering existing firewall configurations are important components of every corporation's network security practice. Unfortunately, this is easier said than done. Firewall configuration files are written in notoriously hard to read languages, using vendorspecific GUIs. A tool that is sorely missing in the arsenal of firewall administrators and auditors is one that allows them to analyze the policy on a firewall.To alleviate some of these difficulties, we designed and implemented two generations of novel firewall analysis tools, which allow the administrator to easily discover and test the global firewall policy. Our tools use a minimal description of the network topology, and directly parse the various vendor-specific low-level configuration files. A key feature of our tools is that they are passive: no packets are sent, and the analysis is performed offline, on a machine that is separate from the firewall itself. A typical question our tools can answer is "from which machines can our DMZ be reached, and with which services?." Thus, our tools complement existing vulnerability analyzers and port scanners, as they can be used before a policy is actually deployed, and they operate on a more understandable level of abstraction. This paper describes the design and architecture of these tools, their evolution from a research prototype to a commercial product, and the lessons we have learned along the way.

Management of heterogeneous security access control configuration using an ontology engineering approach

“…A number of existing techniques can be used to generate [7,13,14], query [15,22,23] and perform structural analysis [3,4,6] on network access control configurations. However, these homogeneous firewall-centric approaches tend not consider their interoperation with other and applicationlayer access controls.…”

Detection of Firewall Policy Anomalies in Real-time Distributed Network Security Appliances

“…Bartal et al [5] designed a UML like language for representing firewall policy rules which are obtained from a model compiler which translates the rules into firewall configuration files. A. Mayer et al [11] designed a tool to analyze firewall policy rules. However, the analysis is done offline i.e.…”

“…However, the need to protect organization network from internal attacks gave rise to the concept of 'Distributed Firewalls. ' The basic idea of 'Distributed Firewalls' is to make every device present in the network, a firewall that filters traffic to and from itself [11]. Firewalls, especially the packet-filtering firewalls contain certain predefined rules which form the security policy of the firewall.…”

Using Argumentation Logic for Firewall Policy Specification and Analysis

“…This work has led to the development of a number of tools that support offline firewall policy analysis and management [10]. However, the analysis process does not detect specific anomaly types such as shadowing and redundancy.…”