Network Security Tip of the Week [6]

This week’s network security tip deals with the risk in making firewall policy changes. Business requirements change often, and to enable the necessary connectivity to support the business, ultimately firewall rule changes must be made. But without the proper checks and balances built into the security change workflow you can end up hurting your security posture.  This is where alignment between the different stakeholders such as application owners, network operations and security teams is so important.

Think about how a change request comes about… let’s say an application owner needs to make an update to his/her application that processes financial information. They submit a request into IT. Someone from the network operations team must review the request and figure out what that actually means in terms of the firewall change, and ultimately process the change. Security’s role is to ensure that the requested change doesn’t create a security gap. Each team has an important role in the process – and you can’t skip over these things, especially when it comes to ensuring the change doesn’t end up harming the business.

As Fabrice, a security engineer from Belgium puts it… “Always analyze the risk that changes to the firewall can introduce. Make sure that the rule is implemented in the exact way that it was approved to avoid security holes.”

Thanks to Fabrice for this tip! If you have a tip you’d like to see shared on our blog, please share with us at [email protected], DM us at @AlgoSec or comment directly on this blog.