This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Trends in Firewall Configuration Errors: Measuring the Holes in Swiss Cheese
July/August 2010 (vol. 14 no. 4)
pp. 58-65
Avishai Wool, Tel Aviv University
The first quantitative evaluation of the quality of corporate firewall configurations appeared in 2004, based on Check Point Firewall-1 rule sets. In general, that survey indicated that corporate firewalls often enforced poorly written rule sets. This article revisits the first survey. In addition to being larger, the current study includes configurations from two major vendors. It also introduces a firewall complexity. The study's findings validate the 2004 study's main observations: firewalls are (still) poorly configured, and a rule -set's complexity is (still) positively correlated with the number of detected configuration errors. However, unlike the 2004 study, the current study doesn't suggest that later software versions have fewer errors.

1. A. Rubin, D. Geer, and M. Ranum, Web Security Sourcebook, Wiley Computer Publishing, 1997.
2. CERT Advisory CA-2003-20: W32/Blaster Worm, CERT/CC, 11 Aug. 2003; www.cert.org/advisoriesCA-2003-20.html.
3. D. Moore et al., "The Spread of the Sapphire/Slammer Worm," 2003; www.caida.org/outreach/papers/2003/sapphire sapphire.html.
4. A. Wool, "A Quantitative Study of Firewall Configuration Errors," Computer, vol. 37, no. 6, 2004, pp. 62–67.
5. Public Company Accounting Reform and Investor Protection Act of 2002 (Sarbanes-Oxley Act), Public Law 107-204, US Statutes at Large, vol. 116, 2002, p. 745.
6. Guidelines on Firewalls and Firewall Policy, US Nat'l Inst. Standards and Technology Special Publication 800-41, 2002; http://csrc.nist.gov/publications/nistpubs/ 800-41sp800-41.pdf.
7. D.D. Welch-Abernathy, Essential Checkpoint Firewall-1: An Installation, Configuration, and Troubleshooting Guide, Addison-Wesley, 2002.
8. D.W. Chapman and A. Fox, Cisco Secure PIX Firewalls, Cisco Press, 2001.
9. A. Mayer, A. Wool, and E. Ziskind, "Offline Firewall Analysis," Int'l J. Information Security, vol. 5, no. 3, 2005, pp. 125–144.
10. A. Wool, "The Use and Usability of Direction-Based Filtering in Firewalls," Computers & Security, vol. 23, no. 6, 2004, pp. 459–468.
11. SANS Institute, "The Twenty Most Critical Internet Security Vulnerabilities," version 4.0, 2007; www.sans.orgtop20/.
12. A. Wool, Firewall Configuration Errors Revisited, tech. report arXiv:0911.1240, 2009; http://arxiv.org/abs0911.1240.

Index Terms:
firewalls, network security, risk sets
Citation:
Avishai Wool, "Trends in Firewall Configuration Errors: Measuring the Holes in Swiss Cheese," IEEE Internet Computing, vol. 14, no. 4, pp. 58-65, July-Aug. 2010, doi:10.1109/MIC.2010.29
Usage of this product signifies your acceptance of the Terms of Use.