Edge & Network

Firewall & IPS

Next-generation firewall policy, intrusion prevention and sandboxing across data centres and the ten Bangladesh Bank offices

The optimiser replays 30 days of logs against the rule base. Rule j is shadowed when an earlier rule i matches a superset of its traffic with a different action, and redundant when the action is the same.

Findings

Finding	Rules	Issue	Traffic affected	Proposal	Status
OPT-21	FW-118	Expired rule still allows two hosting ranges to the GRC admin API	44,120 sessions	Remove ranges 104.248.•••.•••/16 and 45.155.•••.•••/24	AI-proposed
OPT-22	FW-090 ⊂ FW-031	Shadowed: FW-031 already covers FW-090	0	Delete FW-090	AI-proposed
OPT-23	FW-155	Unused for 94 days	0	Disable then delete in 30 days	AI-proposed
OPT-24	FW-077	Any-source SSH from management VLAN	1,204	Restrict to jump hosts	AI-proposed

Shadow and redundancy algorithm

for each rule j in order:
  for each earlier rule i < j:
    if match(i) ⊇ match(j):              # src, dst, app, service sets
       if action(i) ≠ action(j): report SHADOWED(j by i)
       else:                    report REDUNDANT(j by i)
  if hits(j, 90 d) = 0:          report UNUSED(j)
  if src(j) = any and dst(j) ∈ sensitive: report OVERLY_PERMISSIVE(j)
match sets are compared as interval trees on address ranges and ports