Client: Financial Firm A (financial industry)
Project Period: Performed over about 2 months in 2013
Project Background and Topic
Financial Firm A was performing technical vulnerability assessments at least twice a year. Each time, in addition to the regular vulnerability assessment, it selected one topic for an in-depth assessment. The in-depth topic for that year was optimization of security policies, a standing concern for most network firewall practitioners.
Firewall policy optimization is part of a security review, but for firewall operators who do not fully grasp the content and characteristics of every service, it is also a persistent headache. Financial Firm A therefore requested, as part of this vulnerability assessment, a way to optimize the security policies operating on its internal and external network firewalls.
One way to optimize firewall policies is to interview the service owner for each policy and review every firewall policy-setting request or application form to confirm whether the policy is effective and appropriate. In practice, however, it is quite rare for those service owners to be aware of this, and it is also quite rare for every policy to leave evidence such as an application form. That is the operational reality at most companies and institutions.
We therefore studied overseas cases and related techniques and applied a method that maps firewall security-policy objects to firewall logs in order to analyze policy usage. This produced statistics on unused security policies (dormant policies), unnecessary policies, and duplicate policies, and we presented a plan for optimizing the firewall security policies. Security systems to which security policies apply, including firewalls, generally manage new security policies well, but change management such as extending a policy period is difficult in practice. For security solutions that have been operated for a long time, it is effective to perform security-policy optimization analysis and clean up the policies at least once a year.
IT and Information Security Environment
Business and IT Environment
The client calculates base prices for funds and beneficiary certificates, provides them to financial affiliates, and supports fund subscription and redemption transactions. It also provides a trading system for institutional investors, asset-management strategy and risk-management systems, and systems that support direct sales of beneficiary certificates for asset-management companies.
Compared with the financial affiliates to which it belongs, the IT system is relatively small. The IT investment budget is not large, so the operations staff is also small. The network design is simpler than at other financial firms, but transaction volume is relatively high.
Information Protection Environment
As with financial firms of a similar size, most security systems are operated by an external provider under an integrated outsourcing arrangement, and security monitoring is provided 24×7 by a financial affiliate.
This firewall policy optimization analysis covered one representative internal network firewall and one representative external network firewall. About 100 security policies were identified, and at the object level they were broken down into roughly 100,000 to 200,000 objects.
Key Work Performed
The security policies of the target firewalls were broken down to the object level, three months of firewall log traffic was extracted, and the two were mapped. As at other financial institutions, a very large number of records had to be processed, so the data was migrated into an analysis tool we developed in-house and the policies were mapped to the traffic. Mapping the log traffic to each security-policy object produced the practical data needed for optimization, and unnecessarily duplicated security policies could also be cleaned up on an object basis.
Based on the analysis, security policies were regenerated at the object level, registered in the appropriate positions, and operated for a set period while trends were analyzed and monitored. Most practitioners do not know how an actually optimized security policy will affect services, so monitoring for stabilization and re-analysis were repeated over a set period. This confirmed whether unused security policies and the cleaned-up security policies had been optimized.
Project CSF
- A dedicated analysis tool is required to migrate and perform mapping analysis on a large volume of firewall log traffic and finely broken-down policies (in our case, developed in-house)
- Monitoring and re-analysis over a set period to confirm whether the security policies proposed as the optimization approach have stabilized
- Security-policy optimization analysis and application at least once a year
Key Activities and Deliverables
| Phase | Key Work Performed | Deliverables |
|---|---|---|
| Execution Plan Development | – Select the target firewalls – Interview on the target firewall configuration and operational status | – Execution Plan |
| Security Policy Usage-Frequency Analysis | – Extract firewall log traffic – Break down firewall policies – Map the extracted log traffic to the broken-down security policies – Analyze policy usage frequency | – |
| Optimization Approach Development | – Develop a plan to minimize unnecessary paths – Develop a plan to minimize unused security policies (dormant policies) | – Firewall Security Policy Optimization Approach Report |
| Policy Cleanup (Draft) Application and Monitoring | – Apply the cleaned-up security policies (policy regeneration, position of each policy, and so on) – Operate for a set period and monitor policy application – Re-analyze the usage frequency of the cleaned-up security policies | – Firewall Security Policy Cleanup Results Report |
- Sample deliverables: security policy and log-traffic extraction results, security policy-traffic mapping results
