Configuration Errors and Firewall Complexity

By Avishai Wool  |  Posted 2011-02-07 Print this article Print

Configuration errors and firewall complexity

Now that we have defined the FC measure, we can consider the relationship between the number of configuration errors and the firewall complexity. My findings show that 75 percent of the most complex firewalls have at least 20 errors in their configurations.

For example, I found Microsoft services are allowed to enter networks from the outside in 42 percent of the surveyed firewalls-which leaves the network vulnerable to numerous Internet worms. Additionally, a huge proliferation of network worms (such as Blaster) could have been easily blocked by a well-configured firewall.

The issue is that network administrators cannot effectively manage complex firewall rule sets. Therefore, limiting firewall complexity results in greater security. For example, eliminating rules by installing dedicated firewalls for subnets is much safer than connecting an additional subnet to a central firewall and generating more complexity.

As my research indicates, there are very few high-complexity firewalls that are well-configured. Furthermore, there is a clear correlation between rule set complexity and the number of detected errors. It seems that good configuration comes in small policies. Thus, we can say that for well-configured firewalls, good things come in small packages.

Avishai Wool is co-founder and Chief Technology Officer of AlgoSec. Prior to co-founding AlgoSec, Avishai co-founded Lumeta Corporation in 2000 and was chief scientist until 2002. At Lumeta, Avishai was responsible for transforming firewall analyzer technology that he helped create while working at Bell Labs into a commercial product. Prior to Bell Labs spinning off the Lumeta Corporation, Avishai was a member of Bell Lab's technical staff in the secure systems research department. There, Avishai led a team of researchers who created the first research prototypes of the firewall analyzer.

Avishai is also an associate editor of the ACM Transactions on Information and System Security (TISSEC). He has served on the program committee of the leading IEEE and ACM conferences on computer and network security. Avishai has published more than 40 research papers and holds 10 U.S. patents, with many more pending. He is also an associate professor in the School of Electrical Engineering, Tel Aviv University. He holds a Bachelor's degree (cum laude) in Mathematics and Computer Science from Tel Aviv University, and a Master's degree and Ph.D. in Computer Science from the Weizmann Institute of Science. He can be reached at

Ms. Allen received a BS in computer science from the University of Michigan, an MS in electrical engineering from the University of Southern California (USC), and an executive business certificate from the University of California at Los Angeles (UCLA). Her professional affiliations include ACM and IEEE Computer Society.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel