NDLI: Firewall policy change-impact analysis

Please wait, while we are loading the content...

Firewall policy change-impact analysis

Content Provider	ACM Digital Library
Author	Liu, Alex X.
Copyright Year	2012
Abstract	Firewalls are the cornerstones of the security infrastructure for most enterprises. They have been widely deployed for protecting private networks. The quality of the protection provided by a firewall directly depends on the quality of its policy (i.e., configuration). Due to the lack of tools for analyzing firewall policies, many firewalls used today have policy errors. A firewall policy error either creates security holes that will allow malicious traffic to sneak into a private network or blocks legitimate traffic and disrupts normal business processes, which in turn could lead to irreparable, if not tragic, consequences. A major cause of policy errors are policy changes. Firewall policies often need to be changed as networks evolve and new threats emerge. Users behind a firewall often request the firewall administrator to modify rules to allow or protect the operation of some services. In this article, we first present the theory and algorithms for firewall policy change-impact analysis. Our algorithms take as input a firewall policy and a proposed change, then output the accurate impact of the change. Thus, a firewall administrator can verify a proposed change before committing it. We implemented our firewall change-impact analysis algorithms, and tested them on both real-life and synthetic firewall policies. The experimental results show that our algorithms are effective in terms of ensuring firewall policy correctness and efficient in terms of computing the impact of policy changes. Thus, our tool can be practically used in the iterative process of firewall policy design and maintenance. Although the focus of this article is on firewalls, the change-impact analysis algorithms proposed in this article are not limited to firewalls. Rather, they can be applied to other rule-based systems, such as router access control lists (ACLs), as well.
Starting Page	1
Ending Page	24
Page Count	24
File Format	PDF
ISSN	15335399
e-ISSN	15576051
DOI	10.1145/2109211.2109212
Volume Number	11
Issue Number	4
Journal	ACM Transactions on Internet Technology (TOIT)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2008-03-23
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Firewall policy Access control Change-impact analysis
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Network-Level Access Control Policy Analysis and Transformation

Network-level access control policy analysis and transformation

Detecting and Resolving Firewall Policy Anomalies

Modeling and global conflict analysis of firewall policy

Automated pseudo-live testing of firewall configuration enforcement

Conflict classification and analysis of distributed firewall policies

A security scheme for protecting security policies in firewall

Change-Impact Analysis of Firewall Policies

Protecting browsers from DNS rebinding attacks

Firewall policy change-impact analysis

Similar Documents

Network-Level Access Control Policy Analysis and Transformation

Network-level access control policy analysis and transformation

Detecting and Resolving Firewall Policy Anomalies

Modeling and global conflict analysis of firewall policy

Automated pseudo-live testing of firewall configuration enforcement

Conflict classification and analysis of distributed firewall policies

A security scheme for protecting security policies in firewall

Change-Impact Analysis of Firewall Policies

Protecting browsers from DNS rebinding attacks

Firewall policy change-impact analysis