Method and apparatus for automatic risk assessment of a firewall configuration

• US 20060015934A1
• Filed: 07/07/2005
• Published: 01/19/2006
• Est. Priority Date: 07/15/2004
• Status: Abandoned Application

• Current Assignee: Algorithmic Security Incorporated
• Original Assignee: Algorithmic Security Incorporated
• Inventors: Wool, Avishai
• Application Number:
  US11/175,781
• Publication Number:
  US 20060015934A1
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Generally, a method and apparatus are disclosed for Automatic Risk Assessment of a Firewall Configuration. The disclosed invention facilitates the automatic generation of a risk assessment of a given firewall configuration. The prior work of [Mayer et al; 2000, Mayer et al; 2005] and [Wool; 2001] teaches how to analyze Firewall Configurations and produce HTML-based Firewall Analyzer Reports. However, the said Reports produced by the methods of [Mayer et al; 2000, Mayer et al; 2005] are voluminous, and do not identify or rate the risks present within the Firewall Configuration. In the current state of the art, a Firewall administrator or auditor needs to navigate through the Firewall Analyzer Report, and use his or her expertise to identify any Configuration mistakes or badly written rules. The current invention automates this manual process. The method is to let a software module, (the “ADVISOR” module) go over the report, before the human user does, and flag the Configuration errors. Each found mis-configuration is called a risk item. According to a further aspect of the present invention, the ADVISOR module utilizes a Knowledge Base of known risk items. The method may be reduced to practice in the form of a software program that can be executed on a standard personal computer with a standard operating system. A preferred embodiment is an Intel x86—based PC running the RedHat Linux operating system.

Claims

1. A method for parsing a firewall analysis report of a firewall configuration, flagging the risk items, and producing a risk assessment, said method comprising of the following steps:

a. Converting the firewall analysis report into a searchable report format.

b. Searching for each possible risk item in said Converted Report to produce a List-of-Risks.

c. Customizing the List-of-Risks

d. Displaying the Customized List-of-Risks

2. A method as in claim 1 such that the list of possible risk items is maintained in a Knowledge Base.

3. A method as in claim 1 such that said Knowledge Base is maintained in an XML document

4. A method as in claim 1 such that said Knowledge Base is maintained in a relational database

5. A method as in claim 1 such that each risk item in the said Knowledge Base contains

A brief description of the risk item

A risk rating

An explanation about the risk item

Links to further details of the risk

A remedy.

6. A method as in claim 1 such that the Converted Report (1.a) is in XML format

7. A method as in claim 1 such that the Converted Report (1.a) is in a relational database

8. A method as in claim 1 such that the possible risk items are customized before being searched for in said Converted Report (1.b)

9. A method as in claim 1 such that the Customized List-of-Risks (1.d) is sorted in decreasing risk rating order

10. A method as in claim 1 such that the Customized List-of-Risks (1.d) are displayed in HTML format

11. A method as in claim 1 such that the Customized List-of-Risks (1.d) are displayed as a bar chart

12. A system for parsing a firewall analysis report of a firewall configuration, flagging the risk items, and producing a risk assessment, comprising:

a memory for storing computer-readable code; and

a processor operatively coupled to said memory, said processor configured to execute said computer-readable code, said computer-readable code configuring said processor to;

convert the firewall analysis report into a searchable report format;

searching for each possible risk item in said Converted Report to produce a List-of-Risks;

Customizing the List-of-Risks; and

Displaying the Customized List-of-Risks.