Maintaining Firewall Compliancy

We all want to save time and energy spent on menial tasks, so why do we scramble and stress ourselves out when the annual corporate audit is mentioned?  Why is that dreaded firewall compliancy audit so anxiety-inducing each year?  Maintain your firewall compliancy year-round by taking the time to monitor and audit the rules yourself throughout the cycle to reduce your overall workload and stress at audit time.

Firewall rules are set to ensure the security of your company's data while maintaining business functionality.  Sometimes this is a tricky line to balance but compliancy requirements are stated for a reason - in order for your business to function, you must follow some basic rules, whether they are outlined by PCI, SOX, or some other regulatory organization.  Your first firewall audit is going to be painful, but follow some basic guidelines to make this an easier task next time.

Place comments alongside every rule, and state the date when the comment was added.  Complex rules may need to be broken up into a larger number to accommodate the reasons, but there are many common rules used to allow such traffic as DHCP, DNS, and Netbios.  If possible, include a tracking number or administrator's name in non-standard rules in case questions arise.

Develop an audit tracking mechanism.  This way you can return to a previous audit to determine what has changed in the past three to six months.  (Three to six months is a good time frame to audit so that your rules do not change too much and your overall assessment can be performed more efficiently.)  You can create a master firewall rule spreadsheet as well as additional review results forms to append to the master.

Date each audit form completed, and assign administrators tasks to establish accountability.  This ensures that questions are followed up on, and people are aware of the audit practice.  

The firewall review process involves examining every firewall rule and its contents for accuracy and need.  The initial review may result in a number of changes to your rule list, but clean up of any firewall can be a great time saver later on.  If you're unsure what rules could be flagged by an auditor, hire someone to help review the rules with you.  This way you have an auditor's perspective without the headache of failing a large assessment, and you will be well prepared for the audits that count.