Certainly we are no strangers to increased regulations, standards and internal policies, and the resulting audits that impact most organizations – often multiple times per year.
While regulations and ensuing IT audits go beyond firewalls and firewall policies, these devices are often a good place to start when it comes to becoming “audit-ready” and gaining continuous visibility of what’s going on in your network.
Here are six steps to ensure you ace your next firewall audit:
Step 1: Gathering Pertinent Information Before You Undergo an Audit
Without understanding what’s in your network, you have no chance for success come audit time. So prior to undergoing an audit, make sure you can collect all relevant security policies and firewall logs (then you can analyze the logs against the firewall rule base to understand what is actually being used). Make sure you have a diagram of the current network and firewall topologies. Gather all documentation from previous audits, including firewall rules, objects and policy revisions. Review relevant firewall vendor information including OS version, latest patches and default configuration. Understand what servers and information repositories are in the network as well as their relative value to the company.
Once you’ve gathered this information, it is imperative that you can aggregate and update this information in something better than a spreadsheet because you’re most likely going to have multiple audits per year and spreadsheet compliance usually ends up badly.
Step 2: Review Your Firewall Change Management Process
Poor documentation of changes, including why the change is needed, who authorized the change, etc. and poor validation of the impact on the network are two of the most common issues when it comes to firewall change management. As time goes on, this challenge is exacerbated by staff turnover – that internal knowledgebase of why a change was made disappears and then you’re left wondering what you should do – and poor documentation. Make sure you have regular reviews of the procedures for rule-base maintenance and that you can determine:
• If there is a formal and controlled process in place to request, review, approve and implement firewall changes.
• Whether or not all of the changes have been authorized. If you discover unauthorized rule changes, flag them for further investigation.
• If real-time monitoring of changes to the firewall is enabled and access to rule change notifications is granted to authorized personnel. Taking these recommendations into account will get you off to a good start with solidifying your firewall change management processes and ensuring continuous compliance.
Step 3: Audit Your Firewalls’ Physical and OS Security
Make sure you can define and enforce corporate baselines… and report against them so you know where you stand. By reporting against these baselines that you determine, you will always be “in the know” of your firewalls’ configuration status and how they stack up to the policy. Ensure your firewalls and management servers are physically secured with controlled access and that the OS passes common hardening checklists.
Step 4: Cleanup and Optimize Your Rule Base
Over time, firewall policies have more and more rules added, removed and changed, and oftentimes with little documentation for the what, why, who, etc. This creates unnecessary overhead in the audit process and slows down firewall performance. Identify and remove unused rules and objects as well as covered rules, consolidate similar rules and tighten overly permissive rules (i.e. “ANY” in the source address).
Step 5: Conduct a Risk Assessment and Remediate Issues
When reviewing firewall rules and configurations, you want to be able to identify any potentially “risky” rules. What is “risky” can be different for each organization depending on the network and the level of acceptable risk, but there are many frameworks and standards you can leverage that provide a good reference point, in addition to your own definitions of course. Risky rules should be prioritized by severity. Once you’ve gone through your list of risk analysis questions, then it is time to document and assign an action plan for remediation of risks and compliance exceptions found in risk analysis. Once you’ve conducted remediation efforts, make sure you document those as well and verify that these efforts and any rule changes have been completed correctly.
Step 6: Ensure Ongoing Audit-Readiness
When it comes to your firewall configurations, building audit-readiness must be a business process that is maintained over time. “Manual” and “audits” just don’t mix. I’ve personally spoken to customers who prior to leveraging an automation tool spent 2-3 weeks to perform an audit of just ONE firewall, whereas with automation, that painstaking audit process was under a minute or as one customer told me “a push of a button”. Additionally, proper documentation and a solid change process are instrumental pieces to ensuring audit-readiness at the drop of a hat.
A final consideration is that while this article has focused on firewalls, there are different types of firewalls (traditional, next-generation, etc.) as well as secure web gateways, VPNs and other security devices typically found within an organization’s network. Make sure that your audit process covers all of these devices as well. Good luck on your next audit!
