Firewall Policy Advisor for anomaly discovery and rule editing

@inproceedings{citeulike:1904361, abstract = {Firewalls are core elements in network security. However, managing firewall rules, especially for enterprize networks, has become complex and error-prone. Firewall filtering rules have to be carefully written and organized in order to correctly implement the security policy. In addition, inserting or modifying a filtering rule requires thorough analysis of the relationship between this rule and other rules in order to determine the proper order of this rule and commit the updates. In this paper, we present a set of techniques and algorithms that provide (1) automatic discovery of firewall policy anomalies to reveal rule conflicts and potential problems in legacy firewalls, and (2) anomaly-free policy editing for rule insertion, removal and modification. This is implemented in a user-friendly tool called "Firewall Policy Advisor". The Firewall Policy Advisor significantly simplifies the management of any generic firewall policy written as filtering rules, while minimizing network vulnerability due to firewall rule misconfiguration.}, author = {Al-Shaer, E. S. and Hamed, H. H.}, booktitle = {Integrated Network Management, 2003. IFIP/IEEE Eighth International Symposium on}, citeulike-article-id = {1904361}, journal = {Integrated Network Management, 2003. IFIP/IEEE Eighth International Symposium on}, keywords = {firewall, management, network}, pages = {17--30}, posted-at = {2007-11-12 22:26:24}, priority = {5}, title = {Firewall Policy Advisor for anomaly discovery and rule editing}, url = {http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1194157}, year = {2003} }

TY - CONF ID - citeulike:1904361 L3 - citeulike-article-id:1904361 N2 - Firewalls are core elements in network security. However, managing firewall rules, especially for enterprize networks, has become complex and error-prone. Firewall filtering rules have to be carefully written and organized in order to correctly implement the security policy. In addition, inserting or modifying a filtering rule requires thorough analysis of the relationship between this rule and other rules in order to determine the proper order of this rule and commit the updates. In this paper, we present a set of techniques and algorithms that provide (1) automatic discovery of firewall policy anomalies to reveal rule conflicts and potential problems in legacy firewalls, and (2) anomaly-free policy editing for rule insertion, removal and modification. This is implemented in a user-friendly tool called "Firewall Policy Advisor". The Firewall Policy Advisor significantly simplifies the management of any generic firewall policy written as filtering rules, while minimizing network vulnerability due to firewall rule misconfiguration. JF - Integrated Network Management, 2003. IFIP/IEEE Eighth International Symposium on EP - 30 TI - Firewall Policy Advisor for anomaly discovery and rule editing T2 - Integrated Network Management, 2003. IFIP/IEEE Eighth International Symposium on SP - 17 KW - firewall KW - management KW - network AU - Al-Shaer, ES AU - Hamed, HH PY - 2003/// UR - http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1194157 ER -