Method and system for determining whether to alter a firewall configuration

• US 7,937,353 B2
• Filed: 01/15/2007
• Issued: 05/03/2011
• Est. Priority Date: 01/15/2007
• Status: Active Grant

• Current Assignee: Wrp IP Management, LLC
• Original Assignee: International Business Machines Corporation
• Inventors: Sandoval, Medardo Roberto, Bernoth, Andrew
• Primary Examiner(s): Sparks; Donald
• Assistant Examiner(s): Tran; Mai T
• Application Number:
  US11/623,160
• Publication Number:
  US 20080172347A1
• Time in Patent Office: 1,569 Days
• Field of Search: 706/46, 709/225, 709/229, 709/238, 726/13, 726/11
• US Class Current: 706/46
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A method and system for determining whether to alter a firewall configuration. Message flow data associated with a message packet blocked by a firewall is received. The packet was blocked based on the firewall not having a message flow rule that permitted passage of the message packet. Risk values associated with a source network, destination network and destination port are identified by the message flow data. Based on the risk values, an electronic recommendation indicating whether to add to the firewall a message flow rule that permits the message flow to pass is determined and generated.

Claims

1. A computer-implemented method to determine whether to alter a firewall configuration, said method comprising:

a computer receiving message flow data associated with a message packet that was blocked by a firewall based on the firewall not having a message flow rule which permitted passage of said message packet, said message flow data identifying a source network associated with said message packet, a destination network associated with said message packet and a destination port associated with said message packet;

the computer determining a first risk value and a second risk value that indicate levels of trust respectively associated with first and second zones in which said source and destination networks are respectively located, a third risk value that indicates whether said source network is authorized to be a network that is a source of said message packet in a communication session, a fourth risk value that indicates whether said destination network is authorized to be a network that receives said message packet in said communication session, and a fifth risk value that indicates whether said destination port in said destination network is authorized to be a port that receives said message packet in said communication session; and

based on the first, second, third, fourth and fifth risk values, the computer determining and generating an electronic recommendation indicating whether to add to said firewall a message flow rule that permits said message flow to pass.

2. The method of claim 1, further comprising:

the computer assigning a zone risk value to said source network, said assigning said zone risk value including determining that said source network is included in a zone of a plurality of predefined zones, said determining that said source network is included in said zone including determining that a security control associated with said source network is known or unknown and determining that an external access to said source network is filtered, unfiltered, unknown or absent; and

the computer assigning a source network authorization risk value to said source network, said assigning said source network authorization risk value including determining if said source network is expected to act as a source in a network communication session based on predefined criteria,

wherein said determining and generating said electronic recommendation indicating whether to add to said firewall is further based on said zone risk value and said source network authorization risk value.

3. The method of claim 1, further comprising:

the computer assigning a zone risk value to said destination network, said assigning said zone risk value including determining that said destination network is included in a zone of a plurality of predefined zones, said determining that said destination network is included in said zone including determining that a security control associated with said destination network is known or unknown and determining that an external access to said destination network is filtered, unfiltered, unknown or absent;

the computer assigning a destination network authorization risk value to said destination network, said assigning said destination network authorization risk value including classifying said destination network as being expected to act as a destination in a network communication session or being not expected to act as said destination based on predefined criteria;

the computer assigning a destination port authorization risk value to said destination port, said assigning said destination port authorization risk value including classifying said destination port as authorized or unauthorized;

the computer assigning a destination port weight to said destination port authorization risk value, said destination port weight included in a predefined set of port weights; and

the computer assigning a destination breach impact risk value to said destination network, said assigning said destination breach impact risk value including classifying an impact of a breach of said destination network,

wherein said determining and generating said electronic recommendation indicating whether to add to said firewall is further based on said zone risk value, said destination network authorization risk value, said destination port authorization risk value, said destination port weight and said destination breach impact risk value.

4. The method of claim 1, further comprising:

the computer determining that said source network is included in a first zone of a plurality of predefined zones, said determining that said source network is included in said first zone including determining that a security control associated with said source network is known or unknown and determining that an external access to said source network is filtered, unfiltered, unknown or absent;

the computer determining that a destination network is included in a second zone of said plurality of predefined zones, said determining that said destination network is included in said second zone including determining that a security control associated with said destination network is known or unknown and determining that an external access to said destination network is filtered, unfiltered, unknown or absent; and

the computer assigning a communication risk value that classifies a risk associated with a network communication session between said source network and said destination network, said communication risk value associated with said first zone and said second zone.

5. The method of claim 1, wherein said message flow data further includes a source port associated with said message packet, and wherein said method further comprises:

the computer assigning a source authorization risk value to said source network, said assigning said source authorization risk value including determining that said source network is expected to act as a source in a network communication session or not expected to act as said source based on predefined criteria;

the computer assigning, to said source authorization risk value, a source port weight included in a predefined set of port weights; and

the computer assigning a source breach impact risk value to said source network, said assigning said source breach impact risk value including classifying an impact of a breach of said source network,

wherein said determining and generating said electronic recommendation indicating whether to add to said firewall is further based on said source authorization risk value, said source breach impact risk value and said source port weight.

6. The method of claim 1, further comprising:

the computer assigning a source zone risk value to said source network, said assigning said source zone risk value including determining that said source network is included in a first zone of a plurality of predefined zones, said determining that said source network is included in said first zone including determining that a security control associated with said source network is known or unknown and determining that an external access to said source network is filtered, unfiltered, unknown or absent;

the computer assigning a source network authorization risk value to said source network, said assigning said source network authorization risk value including classifying said source network as expected to act as a source in a network communication session or not expected to act as said source based on predefined criteria;

the computer assigning a destination zone risk value to said destination network, said assigning said destination zone risk value including determining that said destination network is included in a second zone of a plurality of predefined zones, said determining that said destination network is included in said second zone including determining that a security control associated with said destination network is known or unknown and determining that an external access to said destination network is filtered, unfiltered, unknown or absent;

the computer assigning a destination network authorization risk value to said destination network, said assigning said destination network authorization risk value including classifying said destination network as expected to act as a destination in a network communication session or not expected to act as said destination based on predefined criteria;

the computer assigning a destination port authorization risk value to said destination port, said assigning said destination port authorization risk value including classifying said destination port as authorized or unauthorized;

the computer assigning a destination port weight to said destination port authorization risk value, said destination port weight included in a predefined set of port weights;

the computer assigning a destination breach impact risk value to said destination network, said assigning said destination breach impact risk value including classifying an impact of a breach of said destination network;

the computer assigning a communication risk value that classifies a risk associated with a network communication session between said source network and said destination network, said communication risk value associated with said first zone and said second zone; and

the computer evaluating an expression (SZ+SNA+(DZ+DNA)*DBI+DPA*DPW)*CR,

wherein SZ is said source zone risk value, SNA is said source network authorization risk value, DZ is said destination zone risk value, DNA is said destination network authorization risk value, DBI is said destination breach impact risk value, DPA is said destination port authorization risk value, DPW is said destination port weight, and CR is said communication risk value, and

wherein said determining and generating said electronic recommendation indicating whether to add to said firewall is further based on said expression (SZ+SNA+(DZ+DNA)*DBI+DPA*DPW)*CR.

7. The method of claim 1, wherein said determining and generating said electronic recommendation indicating whether to add to said firewall said message flow rule are further based on an impact value that weights said fourth risk value and a port weight that weights said fifth risk value, wherein said impact value indicates a level of impact on an organization, said level of impact associated with a breach of data in said second zone in which said destination network is located and based on sensitivity of said data, and wherein said port weight indicates a level of vulnerability of said destination port to said breach.

8. The method of claim 7, further comprising:

determining a sum of said first risk value, said third risk value, said second risk value weighted by said impact value, said fourth risk value weighted by said impact value, and said fifth risk value weighted by said port weight; and

multiplying said sum by a communication risk value that classifies a risk of communicating said message packet from said first zone to said second zone in said communication session, wherein a total risk value is a result of said multiplying said sum by said communication risk value, and wherein said determining and generating said electronic recommendation indicating whether to add to said firewall said message flow rule are further based on said total risk value.

9. A computer system for determining whether to alter a firewall configuration, the computer system comprising:

a CPU;

a computer-readable memory;

a computer-readable, tangible storage device;

first program instructions to receive message flow data associated with a message packet that was blocked by a firewall based on the firewall not having a message flow rule which permitted passage of said message packet, said message flow data identifying a source network associated with said message packet, a destination network associated with said message packet and a destination port associated with said message packet;

second program instructions to determine a first risk value and a second risk value that indicate levels of trust respectively associated with first and second zones in which said source and destination networks are respectively located, a third risk value that indicates whether said source network is authorized to be a network that is a source of said message packet in a communication session, a fourth risk value that indicates whether said destination network is authorized to be a network that receives said message packet in said communication session, and a fifth risk value that indicates whether said destination port in said destination network is authorized to be a port that receives said message packet in said communication session; and

third program instructions to determine and generate, based on the first, second, third, fourth and fifth risk values, an electronic recommendation indicating whether to add to said firewall a message flow rule that permits said message flow to pass,

wherein said first, second and third program instructions are stored on said computer-readable, tangible storage device for execution by said CPU via said computer-readable memory.

10. The computer system of claim 9, further comprising:

fourth program instructions to assign a zone risk value to said source network by determining that said source network is included in a zone of a plurality of predefined zones, wherein said fourth program instructions to assign said zone risk value include fifth program instructions to determine that a security control associated with said source network is known or unknown and sixth program instructions to determine that an external access to said source network is filtered, unfiltered, unknown or absent; and

seventh program instructions to assign a source network authorization risk value to said source network by determining if said source network is expected to act as a source in a network communication session based on predefined criteria,

wherein said electronic recommendation indicating whether to add to said firewall said message flow rule is based on said zone risk value and said source network authorization risk value, and

wherein said fourth, fifth, sixth and seventh program instructions are stored on said computer-readable, tangible storage device for execution by said CPU via said computer-readable memory.

11. The computer system of claim 9, further comprising:

fourth program instructions to assign a zone risk value to said destination network by determining that said destination network is included in a zone of a plurality of predefined zones, wherein said fourth program instructions to assign said zone risk value include fifth program instructions to determine that a security control associated with said destination network is known or unknown and sixth program instructions to determine that an external access to said destination network is filtered, unfiltered, unknown or absent;

seventh program instructions to assign a destination network authorization risk value to said destination network by classifying said destination network as being expected to act as a destination in a network communication session or being not expected to act as said destination based on predefined criteria;

eighth program instructions to assign a destination port authorization risk value to said destination port by classifying said destination port as authorized or unauthorized;

ninth program instructions to assign a destination port weight to said destination port authorization risk value, said destination port weight included in a predefined set of port weights; and

tenth program instructions to assign a destination breach impact risk value to said destination network by classifying an impact of a breach of said destination network,

wherein said electronic recommendation indicating whether to add to said firewall said message flow rule is based on said zone risk value, said destination network authorization risk value, said destination port authorization risk value, said destination port weight and said destination breach impact risk value, and

wherein said fifth, sixth, seventh, eighth, ninth and tenth program instructions are stored on said computer-readable, tangible storage device for execution by said CPU via said computer-readable memory.

12. The computer system of claim 9, further comprising:

fourth program instructions to determine that said source network is included in a first zone of a plurality of predefined zones by determining that a security control associated with said source network is known or unknown and determining that an external access to said source network is filtered, unfiltered, unknown or absent;

fifth program instructions to determine that a destination network is included in a second zone of said plurality of predefined zones by determining that a security control associated with said destination network is known or unknown and determining that an external access to said destination network is filtered, unfiltered, unknown or absent; and

sixth program instructions to assign a communication risk value that classifies a risk associated with a network communication session between said source network and said destination network, said communication risk value associated with said first zone and said second zone,

wherein said fourth, fifth and sixth program instructions are stored on said computer-readable, tangible storage device for execution by said CPU via said computer-readable memory.

13. The computer system of claim 9, wherein said message flow data further includes a source port associated with said message packet, and wherein said computer system further comprises:

fourth program instructions to assign a source authorization risk value to said source network by determining that said source network is expected to act as a source in a network communication session or not expected to act as said source based on predefined criteria;

fifth program instructions to assign a source port weight included in a predefined set of port weights to said source authorization risk value; and

sixth program instructions to assign a source breach impact risk value to said source network by classifying an impact of a breach of said source network,

wherein said electronic recommendation indicating whether to add to said firewall said message flow rule is based on said source authorization risk value, said source breach impact risk value and said source port weight, and

wherein said fourth, fifth and sixth program instructions are stored on said computer-readable, tangible storage device for execution by said CPU via said computer-readable memory.

14. The computer system of claim 9, further comprising:

fourth program instructions to assign a source zone risk value to said source network by determining that said source network is included in a first zone of a plurality of predefined zones, wherein said fourth program instructions to assign said source zone risk value include fifth program instructions to determine that a security control associated with said source network is known or unknown and sixth program instructions to determine that an external access to said source network is filtered, unfiltered, unknown or absent;

seventh program instructions to assign a source network authorization risk value to said source network by classifying said source network as expected to act as a source in a network communication session or not expected to act as said source based on predefined criteria;

eighth program instructions to assign a destination zone risk value to said destination network by determining that said destination network is included in a second zone of a plurality of predefined zones, wherein said eighth program instructions to assign said destination zone risk value include ninth program instructions to determine that a security control associated with said destination network is known or unknown and tenth program instructions to determine that an external access to said destination network is filtered, unfiltered, unknown or absent;

eleventh program instructions to assign a destination network authorization risk value to said destination network by classifying said destination network as expected to act as a destination in a network communication session or not expected to act as said destination based on predefined criteria;

twelfth program instructions to assign a destination port authorization risk value to said destination port by classifying said destination port as authorized or unauthorized;

thirteenth program instructions to assign a destination port weight to said destination port authorization risk value, said destination port weight included in a predefined set of port weights;

fourteenth program instructions to assign a destination breach impact risk value to said destination network by classifying an impact of a breach of said destination network; and

fifteenth program instructions to assign a communication risk value that classifies a risk associated with a network communication session between said source network and said destination network, said communication risk value associated with said first zone and said second zone; and

sixteenth program instructions to evaluate an expression (SZ+SNA+(DZ+DNA)*DBI+DPA*DPW)*CR,

wherein SZ is said source zone risk value, SNA is said source network authorization risk value, DZ is said destination zone risk value, DNA is said destination network authorization risk value, DBI is said destination breach impact risk value, DPA is said destination port authorization risk value, DPW is said destination port weight, and CR is said communication risk value,

wherein said electronic recommendation is based on said expression (SZ+SNA+(DZ+DNA)*DBI+DPA*DPW)*CR, and

wherein said fourth through said sixteenth program instructions are stored on said computer-readable, tangible storage device for execution by said CPU via said computer-readable memory.

15. A computer program product comprising a computer-readable, tangible storage device(s) and computer-readable program instructions stored on the computer-readable, tangible storage device(s) to determine whether to alter a firewall configuration, the computer-readable program instructions, when executed by a CPU:

receive message flow data associated with a message packet that was blocked by a firewall based on the firewall not having a message flow rule which permitted passage of said message packet, said message flow data identifying source network associated with said message packet, a destination network associated with said message packet and a destination port associated with said message packet;

determine a first risk value and a second risk value that indicate levels of trust respectively associated with first and second zones in which said source and destination networks are respectively located, a third risk value that indicates whether said source network is authorized to be a network that is a source of said message packet in a communication session, a fourth risk value that indicates whether said destination network is authorized to be a network that receives said message packet in said communication session, and a fifth risk value that indicates whether said destination port in said destination network is authorized to be a port that receives said message packet in said communication session; and

based on the first, second, third, fourth and fifth risk values, determine and generate an electronic recommendation indicating whether to add to said firewall a message flow rule that permits said message flow to pass.

16. The program product of claim 15, wherein the computer-readable program instructions, when executed by the CPU further:

assign a zone risk value to said source network by determining that said source network is included in a zone of a plurality of predefined zones, wherein said determining that said source network is included in said zone includes determining that a security control associated with said source network is known or unknown and determining that an external access to said source network is filtered, unfiltered, unknown or absent; and

assign a source network authorization risk value to said source network by determining if said source network is expected to act as a source in a network communication session based on predefined criteria,

wherein said electronic recommendation is based on said zone risk value and said source network authorization risk value.

17. The program product of claim 15, wherein the computer-readable program instructions, when executed by the CPU further:

assign a zone risk value to said destination network by determining that said destination network is included in a zone of a plurality of predefined zones, wherein determining that said destination network is included in said zone includes determining that a security control associated with said destination network is known or unknown and determining that an external access to said destination network is filtered, unfiltered, unknown or absent;

assign a destination network authorization risk value to said destination network by classifying said destination network as being expected to act as a destination in a network communication session or being not expected to act as said destination based on predefined criteria;

assign a destination port authorization risk value to said destination port by classifying said destination port as authorized or unauthorized;

assign a destination port weight to said destination port authorization risk value, said destination port weight included in a predefined set of port weights; and

assign a destination breach impact risk value to said destination network by classifying an impact of a breach of said destination network,

wherein said electronic recommendation is based on said zone risk value, said destination network authorization risk value, said destination port authorization risk value, said destination port weight and said destination breach impact risk value.

18. The program product of claim 15, wherein the computer-readable program instructions, when executed by the CPU further:

determine that said source network is included in a first zone of a plurality of predefined zones by determining that a security control associated with said source network is known or unknown and determining that an external access to said source network is filtered, unfiltered, unknown or absent;

determine that a destination network is included in a second zone of said plurality of predefined zones by determining that a security control associated with said destination network is known or unknown and determining that an external access to said destination network is filtered, unfiltered, unknown or absent; and

assign a communication risk value that classifies a risk associated with a network communication session between said source network and said destination network, said communication risk value associated with said first zone and said second zone.

19. The program product of claim 15, wherein said message flow data further includes a source port associated with said message packet, and wherein the computer-readable program instructions, when executed by the CPU further:

assign a source authorization risk value to said source network by determining that said source network is expected to act as a source in a network communication session or not expected to act as said source based on predefined criteria;

assign a source port weight included in a predefined set of port weights to said source authorization risk value; and

assign a source breach impact risk value to said source network by classifying an impact of a breach of said source network,

wherein said electronic recommendation is based on said source authorization risk value, said source breach impact risk value and said source port weight.

20. The program product of claim 15, wherein the computer-readable program instructions, when executed by the CPU further:

assign a source zone risk value to said source network by determining that said source network is included in a first zone of a plurality of predefined zones, wherein said determining that said source network is included in said first zone includes determining that a security control associated with said source network is known or unknown and determining that an external access to said source network is filtered, unfiltered, unknown or absent;

assign a source network authorization risk value to said source network by classifying said source network as expected to act as a source in a network communication session or not expected to act as said source based on predefined criteria;

assign a destination zone risk value to said destination network by determining that said destination network is included in a second zone of a plurality of predefined zones, wherein said determining that said destination network is included in said second zone includes determining that a security control associated with said destination network is known or unknown and determining that an external access to said destination network is filtered, unfiltered, unknown or absent;

assign a destination network authorization risk value to said destination network by classifying said destination network as expected to act as a destination in a network communication session or not expected to act as said destination based on predefined criteria;

assign a destination port authorization risk value to said destination port by classifying said destination port as authorized or unauthorized;

assign a destination port weight to said destination port authorization risk value, said destination port weight included in a predefined set of port weights;

assign a destination breach impact risk value to said destination network by classifying an impact of a breach of said destination network; and

assign a communication risk value that classifies a risk associated with a network communication session between said source network and said destination network, said communication risk value associated with said first zone and said second zone,

evaluate said total risk value an expression (SZ+SNA+(DZ+DNA)*DBI+DPA*DPW)*CR,

wherein SZ is said source zone risk value, SNA is said source network authorization risk value, DZ is said destination zone risk value, DNA is said destination network authorization risk value, DBI is said destination breach impact risk value, DPA is said destination port authorization risk value, DPW is said destination port weight, and CR is said communication risk value, and

wherein said electronic recommendation is based on said expression (SZ+SNA+(DZ+DNA)*DBI+DPA*DPW)*CR.