Attack Graph Based Optimizations of Firewall Rules

The optimal functioning of firewalls is of paramount importance from both security and user perspective. Various methods have been developed and implemented to enhance firewall performance, thereby preventing them from becoming network bottlenecks. However, the measurement of security risks inherent in firewall rules, or their correlation with the protected network and policy, remains a less explored area. Currently, firewall rule validation is conducted by IT security professionals through the manual review of rule lists. These lists, which can comprise hundreds of rules, require extensive examination to precisely determine the routes allowed by the firewall, especially when the rule set is complex due to software ergonomic deficiencies. Additionally, assessing the impact of rule changes prompted by modifications in network infrastructure or business requirements on firewall security is challenging. Rapid and precise intervention is crucial in the event of an attack. This article proposes a novel solution to these challenges by demonstrating that an attack graph can store information that directly influences firewall rules and quantifies the associated risks. The developed application also provides a graphical interface to monitor endpoint reachability and the rules affecting it. The article offers a concise yet comprehensive overview of the fundamental principles of firewalls and the optimization procedures currently in practice. It presents the potential of using data collected in the attack graph to calculate the risk associated with firewall rules, detailing the risk calculation algorithm and computational results from the self-developed software. The study explores the possibilities for optimization and automation in firewall rule risk assessment by integrating additional data [1].