Towards standardising firewall reporting

Abstract

Rubin and Greer stated that “The single most important factor of your firewall’s security is how you configure it.” [17]. However, firewall configuration is known to be difficult to get right. In particular domains, such as SCADA networks, while there are best practice standards that help, an overlooked component is the specification of firewall reporting policies. Our research tackles this question from first principles: we ask what are the uses of firewall reports, and we allow these to guide how reporting should be performed. We approach the problem by formalising the notion of scope and granularity of a report across several dimensions: time, network elements, policies, etc.