Firewall management; arranging traffic permissions according to business needs, recording changes, version tracking and reviewing event records. In firewall management, the purpose of each rule, its owner and when it will be reviewed should be known.
What information should be included in the rule inventory?
Source and target addresses, required service, application owner, business justification and change date should be recorded. Adding an expiration or reconsideration date to temporary permissions makes it easier to spot forgotten access.
Just because the rule has not been used recently does not automatically mean that it can be safely deleted. Verification should be made with the owner of an accounting or disaster recovery application that is used periodically.
Why are rule order and scope important?
A broad permission may change the expected effect of a more specific control. The addition of a new rule should be reviewed alongside existing traffic flows. The FortiOS policy document describes matching parameters and traffic direction.
Technical reference: Fortinet — FortiOS 7.6.3 firewall policies.
The check does not end with just trying to run the connection that should be allowed. It should also be verified that access to the same target is blocked from a source that should not be allowed.
How to manage update and event logging?
Release tracking, manufacturer announcement, and the organization's maintenance window are handled together. Before the update, backup, access and return preparations are made. VPN, internet and critical services should be checked again after application.
If it is not defined what to track in the event log, a large number of records may not produce operational value. Determine which incident will be reported to whom, the reviewer, and access rights. Do not keep records in a public folder that is visible to everyone.
What conclusions should be in the management report?
- Justifications for new, changed and abolished rules.
- Expiring temporary permissions and rules pending owner verification.
- Performed version changes and functional tests.
- Events requiring investigation and actions taken.
- Status of backups and remaining open dependencies.
These headings are an example of report scope. For your existing devices and apps firewall management You can scope your work.
Related resources
Official sources
Technical documentation and legislation may change; The relevant version and current text should be checked before application.
Frequently Asked Questions
Is collecting logs the same as security monitoring?
No. Making sense of the collected record, prioritizing it and transferring it to the responsible person are separate tasks.
What to do before deleting a rule?
The business owner, usage history, dependent applications, and fallback method should be checked.