Trends in firewall configuration errors: Measuring the holes in Swiss cheese

Avishai Wool*

*Corresponding author for this work

Research output: Contribution to journalReview articlepeer-review

61 Scopus citations

Abstract

The first quantitative evaluation of the quality of corporate firewall configurations appeared in 2004, based on Check Point Firewall-1 rule sets. In general, that survey indicated that corporate firewalls often enforced poorly written rule sets. This article revisits the first survey. In addition to being larger, the current study includes configurations from two major vendors. It also introduces a firewall complexity. The study's findings validate the 2004 study's main observations: firewalls are (still) poorly configured, and a rule-set's complexity is (still) positively correlated with the number of detected configuration errors. However, unlike the 2004 study, the current study doesn't suggest that later software versions have fewer errors.

Original languageEnglish
Article number5440153
Pages (from-to)58-65
Number of pages8
JournalIEEE Internet Computing
Volume14
Issue number4
DOIs
StatePublished - Jul 2010

Keywords

  • firewalls
  • network security
  • risk sets

Fingerprint

Dive into the research topics of 'Trends in firewall configuration errors: Measuring the holes in Swiss cheese'. Together they form a unique fingerprint.

Cite this