Stringent standards such as SOX, PCI-DSS, and HIPAA, are the reasons why network security audits are getting good coverage these days. Your network safety, business relationship with customers make you ensure that the network is secure even if you don’t need to comply with any of these standards. Firewall audits are one good way through which you can increase your chances of catching any threat or weakness present in the network security posture. They also help in ensuring that the security controls and policy controls are being reviewed. Our Firewall Audit Checklist is meant to ease the process for you.

Infrassist recommends regular firewall audits as firewalls require constant observation to provide optimum security for your enterprise. Although, most companies assume that they are protected and do not perform a regular firewall audit. Here are some reasons why firewall audit should be a regular practice:

Enterprises think that they did secure configuration, but it is not truly secure
Firewalls are not investigated on a day to day basis
Small things like a temporary rule or a disabled rule can cause security breaches
Firewalls are not logged into every day to check the dashboards
Backups are not configured well
Multi-factor authentication is missing

While a firewall audit may seem like a straightforward process, it requires as much effort as a security assessment does. Let’s look at the firewall audit checklist:

Gather all information > Pre-audit

Ensure to have copies of security policies
Safety Check for access to all firewall logs
Details on current network dynamics
Review documentation from previous audits
Find all relevant ISPs and VPNs
Get all firewall vendor information
Comprehend the setup of all key servers

Review the Change Management Process:

Check the procedures for rule-base maintenance
Analyze the process for firewall changes
Ensure whether all previous changes were authorized

Audit the Firewall’s Physical and OS Security:

Ensure that your management servers are physically secure
Check the access procedures to these restricted locations
Verify all vendor updates have been applied
Make sure the OS passes common hardening checks
Assess the procedures for device administration

Optimize Your Rule Base:

Delete redundant rules
Delete or disable unused objects
Evaluate the order of firewall rules for performance
Remove unused connections
Document the rules and changes for future reference

Conduct a Risk Assessment:

Review industry best practices for methodology
Ask a series of thorough questions
Document your assessment and save it as a report

Improve Firewall Processes:

Replace error-prone manual tasks with automation
Make sure all auditing activities have been documented
Create an actionable firewall change workflow

If all the above steps are followed carefully, it is much easier to clear the firewall audits. For a large set of firewall audit, removing the margin for errors manually makes it worth the cost and effort. While this does cover all the scenarios that the engineers may encounter while evaluating the firewalls, it does give a broader idea of the actions that the engineers should take.

With decent experience in performing firewall audits, Infrassist Technologies has gained in-depth knowledge and expertise in performing firewall audits in diverse network scenarios. Look at our sample firewall report.