Method and apparatus for graphical presentation of firewall security policy

A graphical representation of the firewall and a network coupled to the firewall is generated and displayed. A number of an inbound port of the network is displayed. An arrow adjacent to the port number pointing toward the network is displayed to indicate that a communication is permitted to the port. The port number and the arrow are located between an icon for the network and an icon for the firewall. A port number of a destination of a communication originating from the network is displayed. Also, another arrow adjacent to the destination port number pointing toward the firewall is displayed to indicate that a communication is permitted to the destination port number. The destination port number and the other arrow are located between an icon for the network and an icon for the firewall.

BACKGROUND OF THE INVENTION

The invention relates generally to computer networks, and deals more particularly with a technique to graphically present data flows, vulnerabilities and misconfigurations in a firewall.

To provide security, there are separate networks with security controls between each network. This enables an enterprise network to house confidential data separately from publicly available data, to separate financial networks from service networks, etc. All of these design considerations provide confidentiality, integrity and availability. Because external entities are not under complete control of the enterprise and are open to unknown users who may not be trusted, these networks are not considered trusted. Typically, an enterprise intranet is considered known and trusted because it houses internal communications within the enterprise. While this intranet communicates with an external network environment either to transmit or receive data communications, the intranet generally will not need to receive inbound communications directly from an untrusted networks. An extranet comprises known but untrusted network environments, such as “Demilitarized Zones (“DMZ”),” “Service networks” and “Business to Business (B2B) interconnections.” These networks are semi-secure because the owners and users are generally known but not trusted. There are also external unknown and untrusted networks such as the Open Internet. These are the riskiest types of networks with which to communicate.

The security controls between networks is often provided by a firewall. A firewall is a network device that can protect a variety of networks by inspecting, filtering and blocking data which flows to and through the network. The firewall can be installed between known and trusted networks, known and untrusted networks, and unknown and untrusted networks. A firewall is comprised of a routing engine and filters to screen out unwanted data communications. The firewall is responsible for enforcing a security policy for incoming and outgoing communications. The security policy may define the types of networks the known network is permitted to communicate and what protocols are permitted for the communications. For example, the firewall may only permit communications between the intranet and the enterprise's “DMZ”, which is located between a trusted internal and untrusted and unknown external network. An enterprise's DMZ is comprised of servers and other related devices that are supplied and managed by the enterprise, but generally do not contain unencrytped sensitive data. Therefore, if the servers in the enterprise's DMZ are corrupted by a communication from another, untrusted network, the damage is limited. Because the management of these DMZ servers is performed by the enterprise itself, a measure of security exists in the enterprise DMZ which does not exist in the Open Internet. There are cases when a network does not have a firewall in which case it connects directly to other networks through a router.

Not only can a firewall deny traffic to and from networks, it can more granularly limit traffic between networks by limiting which hosts have access to communicate to or from network entities. These hosts are considered sophisticated enough to avoid receipt of damaging messages. These hosts are listed in a firewall ruleset. The firewall checks the ruleset for host identifiers (ex. IP Address or hostname) before permitting the communications. Audits of these rulesets are necessary to understand which hosts have outbound connectivity and determine if any of the rules violate a pre-specified corporate security mandate.

A third way a firewall can limit traffic between networks is by communication protocols and ports. The most common communication protocols are TCP, UDP and ICMP. Each of these protocols includes usage criteria such as the range of ports used by TCP and UDP for certain types of requests. The TCP and UDP ports indicate which applications in the recipient device should provide the requested services. It is desirable in some cases to limit the range of ports for certain types of communications. The limitation on the range of ports facilitates the handling of the requested service. For example, many programs are written to open any available TCP or UDP port. This makes the identification of the application using such a port difficult. In some such cases it is possible to restrict the range of ports available to these applications to assist in identifying which application is using the port. It may be preferable for some networks to not allow communication using an application requiring an unlimited range of TCP or UDP ports.

The protocols also may specify the types of ICMP which are permitted. Example types are Echo Request (which sends a ping), Echo Reply (which responds to a ping) and Host Unreachable. Some networks may not wish to accept certain types of ICMP messages. For example, some destination networks deny Echo Request messages from untrusted networks because they are potential denial of service attacks.

Some protocols are more controllable than others. For example, TCP provides “handshaking” for every communication whereas UDP does not. So, TCP is more controllable and trustworthy than UDP. Therefore, some networks may not want to accept UDP communications. It was known for an administrator to check whether the firewall permits incoming UDP communications, and if so, report a security violation. These checks were performed by reviewing the firewall access control lists or by sniffing traffic.

The security policy of a firewall also may prohibit certain message flows, such as those involving certain versions of Telnet and the Berkely R commands (rshell, rlogin) because these protocols have known security holes. It was known for a systems administrator to check if the firewall permits such message flows, and if so, report a security violation. These checks were performed by reviewing the firewall access control lists or by sniffing traffic.

The vast configurability of firewall rules equates to very complex rulesets with significant potential for mistakes. Filter rules should be verified regularly to ensure they conform to the enterprise security policy, are configured properly and function as intended. Traditionally, this is completed manually by a systems administrator or a person outside of the day-to-day operations of the firewall such as a security administrator. The systems administrator or security administrator reviews each firewall rule to confirm the network type of each IP address and ensure that the data flows configured in the firewall are acceptable according to the enterprise security policy. While this technique is effective, it requires tedious, human review of the configuration information from each network with which communication is desired, and there can be many such networks. Routers and firewalls of networks are often changed, and this may require the systems administrator or security administrator to repeat the foregoing investigation.

A Solsoft computer program (by Solsoft Inc.) was known to display a diagram of networks connected to each other, and firewalls within the networks. This program includes an option to color code each of the networks. This option was commercially used (more than one year ago) to color code each network based on the security level of the network. This known color coding was blue for a most secure intranet, green for protected DMZ or Service network, yellow for a DMZ or Service network and red for an insecure network such as the Open Internet.

EP 1119151A2 to Alain et al. disclose a computer program which displays a graphical representation of a network; the data flows of the network can be determined through a series of queries.

An object of the present invention is to improve the process of reporting data flows, data flow vulnerabilities, data flow misconfigurations and improper firewall settings.

SUMMARY OF THE INVENTION

The invention resides in a system, method and computer program product for reporting a data flow in a firewall. A graphical representation of the firewall and a network coupled to the firewall is generated and displayed. A number of an inbound port of the network is displayed. An arrow adjacent to the port number pointing toward the network is displayed to indicate that a communication is permitted to the port.

According to a feature of the present invention, the port number and the arrow are located between an icon for the network and an icon for the firewall.

According to another feature of the present invention, a port number of a destination of a communication originating from the network is displayed. Also, another arrow adjacent to the destination port number pointing toward the firewall is displayed to indicate that a communication is permitted to the destination port number. The destination port number and the other arrow are located between an icon for the network and an icon for the firewall.

The invention also resides in a system, method and program product for reporting data flow vulnerabilities in a firewall. A table including definitions of a plurality of rules is generated and displayed. Each of the definitions includes an entry for a source IP address of a permitted but vulnerable data flow, an entry for a destination IP address of the permitted but vulnerable data flow, and an entry for a protocol or destination port of the permitted but vulnerable data flow. The source IP address entry in the table is color coded to indicate a security level of a source network containing the source IP address. The destination IP address entry in the displayed table is color coded to indicate a security level of a destination network containing the destination IP address.

According to a feature of the present invention, the definition for each of the rules includes both the entry for the protocol and the entry for the destination port. The entry for the protocol and/or the entry for the destination port is color coded to indicate a severity of the vulnerability.

According to another feature of the present invention, the table also includes other definitions of another plurality of rules. Each of the other definitions including an entry for a source IP address of a vulnerable, denied data flow, an entry for a destination address of the vulnerable, denied data flow, and an entry for a protocol or destination port of the vulnerable, denied data flow. The source IP address entry in the table is color coded to indicate a security level of a source network containing the source IP address of the vulnerable, denied data flow. The destination IP address entry in the table is color coded to indicate a security level of a destination network containing the destination IP address of the vulnerable, denied data flow.

The invention also resides in a system, method and computer program product for reporting data flow misconfigurations in a firewall. A table including definitions of a plurality of rules is generated and displayed. Each of the definitions includes an entry for a source IP address of a permitted but misconfigured data flow, an entry for a destination IP address of the permitted but misconfigured data flow, and an entry for a protocol or destination port of the permitted but misconfigured data flow. The source IP address entry in the table is color coded to indicate a security level of a source network containing the source IP address. The destination IP address entry in the table is color coded to indicate a security level of a destination network containing the destination IP address.

According to a feature of the present invention, the definition for each of the rules includes both the entry for the protocol and the entry for said destination port. The entry for the protocol or the entry for the port is color coded to indicate a severity of the misconfiguration.

The invention also resides in a system, method and computer program product for reporting improper settings in a firewall. A table including descriptions and security-risk severity ratings of a respective plurality of settings of the firewall is generated and displayed. Some or all of the settings are improper. The security-risk ratings or descriptions of the improper settings are color coded to indicate respective security-risk severities of the improper settings.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The present invention will now be described in detail with reference to the figures.FIG. 1illustrates four networks11-14. Network13has a firewall21which filters communications between network13and networks11and12. There may be routers (not shown) within networks11,12and13. By way of example, network13is a secure, (“Blue”) enterprise intranet, network12is a semi-secure (“Yellow”) DMZ, and network11is semi-trusted (“Green”) network (from the point of view of network13). By way of example, network14is an untrusted network such as the Open Internet, and is coupled to DMZ network12via another firewall22of DMZ network12. However, the present invention can be used with a wide variety of networks. Network13comprises a firewall management computer50which manages firewall21. The management functions include authorization, logging, and remote administration. Network13also comprises a firewall security checking server51which is responsible for checking the security policy within firewall21and reporting any vulnerabilities, misconfigurations and problems in settings. (Alternately, firewall security checking server51could exist on a standalone network.) Network13also comprises one or more servers29and workstations (not shown). Network11comprises one or more servers31which can communicate with server29via firewall21. Likewise, network12comprises one or more servers32which can communicate with server29via firewall21. Network14comprises one or more servers34which can communicate with servers32via firewall22.

FIG. 2illustrates a firewall security checking program100within memory70and/or storage72of firewall security checking server51for execution by CPU74. Security checking program100identifies all data flows and highlights vulnerable and misconfigured data flows and improper firewall settings permitted by firewall21, and then displays them as described below. Security checking program100includes the following program functions or modules. A program function110gathers configuration information about firewall21needed to determine the data flows, vulnerabilities and misconfigurations. A program function112gathers firewall interface and zone/network information for each firewall, such as which types of networks connect to firewall21. The interface and zone information is needed to correlate a set of data flow rules to the proper firewall interface and adjacent zone/network. In the illustrated example, the different types of networks include a “Blue” zone such as the enterprise intranet, a “Green” zone such as a network accessible only to semi-trusted entities such as business partners, a “Yellow” zone such as a DMZ for an intranet, and a “Red” zone such as the Internet. A program function120checks data flow rules for each interface, such as what protocols and ports should be permitted to/through the interface. A program function130determines vulnerabilities in data flows such as use of vulnerable communication programs, protocols and ports. A program function140determines misconfigurations in data flows such as when the firewall permits two contradictory rules. A program function150determines errors in settings within the firewall unrelated to data flow rules, such as settings for an SNMP function (for notification and management of events) and administration of the firewall21. A program function160controls a computer display to graphically present the data flows, vulnerabilities and misconfigurations in a manner which effectively shows the data flows, vulnerabilities and misconfigurations to the user.

As illustrated inFIG. 3, program function110requests and gathers configuration information about the firewall21needed to determine data flows, vulnerabilities and misconfigurations within firewall21. The configuration information comprises a set of firewall data flow rules, firewall settings, authentication methods and information about the security level of each zone/network connected to the firewall. For example, a Cisco Pix firewall specifies a security level of an adjacent zone by a number 0-100 where “0” is the lowest security, i.e. the (red) Internet, and “100” is the highest security, i.e. the (blue) intranet. Because the green zone has a higher security representation than the yellow zone, it would accordingly be represented by a higher number. The firewall “rules” specify which data flows are permitted and not permitted (a) into the firewall, (b) out of the firewall and (c) through the firewall, i.e. from one firewall interface to another firewall interface. A “data flow” may be defined by a source IP address, destination IP address, IP protocol and port number of a communication. The firewall “interfaces” indicate a physical connection to a network and therefore define the networks which are serviced by the firewall. Program function110obtains the configuration information by request (for example by secure shell or e-mail from an administrator) directly from configuration files within firewall21, or by request from firewall management console50(step302). After gathering the information, program function110stores the configuration information as a configuration table or file304in storage305(step306).

As illustrated inFIG. 4, program function112gathers zone/network information needed to determine data flows, vulnerabilities and misconfigurations within firewall21. In step402, program function112reads from storage305, the configuration file304generated by program function110. Then, program function112parses the file304to identify the firewall21interfaces (steps402and404). Then, program function112determines if the configuration file304contains other network information, such as the range of IP addresses for each network, the IP address of each device in the network, and description of routing to networks not directly connected to firewall21(step406). If configuration file304does not contain all of this network information, then program function112queries the user to input the missing network information (step408). If the configuration file304contains all of this network information or after the user enters the missing network information, program function112determines if the configuration file304indicates a numerical security level of each zone (decision410). If not, then program function112queries the user to input the numerical security level of each zone, preferably the numerical value on a scale of one to one hundred; similar to security rankings used by the Cisco PIX firewall (step412). If the configuration file contains the security level information of each zone, or after the user enters the zone security level information, program function112“collates” the zone information, i.e. associates with each firewall interface the security levels of each zone or remote network. Then, program function112writes the collated zone information to a zone table404in storage305(step414).

As noted above, program function120analyses data flow rules for each interface. Program function120operates as follows. In step502, the data flow checking program function120reads the firewall interface and zone information from the zone table404. Program function120also reads data flow rules from the configuration file304. Then, program function120selects one of the firewall interfaces to begin a data flow rule checking to correlate to each interface, the rules that apply to the interface (step506). Assuming there is still an interface yet to be analyzed for firewall21(decision508, no branch), program function120reads the first rule (step510), and determines if it is associated with the interface currently being evaluated (decision512). This determination is made by evaluating IP addresses or access list names. If the rule is associated with the interface currently being evaluated (decision512, yes branch), program function120writes the rule to a data flow checking table514(step526). However, if the rule is not so associated or after step516, program function120determines if this is the last rule in the ruleset to consider (decision520). If not (decision520, no branch), then program function120loops back to step510to select the next rule in the ruleset and determine whether it is associated with the interface currently being evaluated. Steps510,512,516and520are repeated for each rule in the ruleset. Then, (decision520, yes branch), program function120determines from data flow checking table514if any rules from the ruleset were found to be associated with the current interface being evaluated (decision524). If not, program function120writes default behavior to the data flow checking table514for this interface (step526). The default behavior comprises logic of the specific firewall type, for example, how it handles null rulesets. After decision524, yes branch, where there was at least one rule from the ruleset found to be associated with the current interface or after step526, program function120loops back to step506to repeat the foregoing steps508,510,512,516,520,524and526for the next interface of firewall21.

Refer again to decision508, yes branch, where program function120has evaluated the last interface for firewall21. At that time, program function120determines if any rules in the ruleset have not been found to be associated with an interface of firewall21(decision530). If so, program function130writes default behavior to data flow checking table514(step532). The default behavior comprises logic of the specific firewall type, for example, how it handles rules that have not been associated with an interface. However, if program function120has found all of the rules of the ruleset to be associated with an interface of firewall21(or after step532), then program function120has completed its checking, and proceeds to step602to invoke program function130.

FIG. 6illustrates program function130in detail. As noted above, program function130determines data flow vulnerabilities such as use of vulnerable communication programs, protocols and ports for certain firewall interfaces and their respective zones. A vulnerability database603in storage305is maintained with current information. The vulnerability database603lists known data flow vulnerabilities based on type of service, protocol, port number, respective zones, and other factors. Some examples of data flow vulnerabilities are the following:

a communication using FTP because userID and password flow in the clear, i.e. unencrypted,

an unauthenticated communication permitted from a lower security zone to a higher security zone,

a permitted communication using inherently risky remote access commands, such as RSHELL, RLOGIN, RHOST,

a rule allowing more ports than are required by the communication,

a communication commonly implemented by a vulnerable software product,

a communication using Telnet rather than its more secure equivalent (SSH),

a communication permitted into a UDP printer port,

a communication permitting inherently risky services, such as netbios, DNS, SMTP,

a communication permitting all ICMP types, and

a communication permitted from a more secure zone to a less secure zone without control by a ruleset to limit who can initiate such a communication.

In step602, program function130reads the contents of data flow checking table514which correlates each rule in the ruleset for firewall21to the respective interface of firewall21. Then, program function130compares the first rule in514to the list of vulnerabilities in the vulnerability database603(step604). If the first one of the rules matches one or more of the vulnerabilities in the vulnerability database603(decision606, yes branch), then program function130writes the combination of interface/zone and rule into a “found-vulnerability” database610(step608). However, if the first rule does not match any of the vulnerabilities in vulnerability data base603(decision606, no branch, or after step608), program function130determines if this is the last rule in data flow checking table514to be considered (decision630). If not, then program function130loops back to step604to repeat steps604,606,608and630for the next rule. After all the rules in data flow checking table514have been compared to the vulnerability database603(decision630, yes branch), then program function130proceeds to step702to invoke program function140.

FIG. 7illustrates program function140in detail. As explained above, program function140determines data flow misconfigurations such as when two or more firewall rules contradict each other, two or more firewall rules are redundant of each other or when a firewall rule specifies a source zone or destination zone that is not consistent with the interfaces of the firewall. In step702, program function140reads the contents of data flow checking table514which contains each rule in the ruleset for firewall21. Next, program function140analyses a first data flow rule in514for “interface/zone” consistency, i.e. consistency with its interface and respective zones (step704). For example, if an inbound data flow rule specifies a source IP address, firewall interface and destination IP address, program function140checks if the source IP address is in the source zone for the specified interface. Also, for outbound rules, program function140checks if the destination IP address is in the destination zone for the specified interface. As another example of processing in step704, program function140checks if the source IP address and destination IP address are in the same network. As another example of processing in step704, program function140checks if there are any data flows terminating at the firewall itself. Next, program function140checks the first one of the data flow rules for “rule” redundancy, i.e. redundancy with another data flow rule considered in a previous iteration of program function140(step706). A redundancy exists when two rules permit the same data flow. This check is made by comparing each rule against each other rule. Next, program function140checks the first data flow rule for “rule” contradiction, i.e. contradiction with a previous one of the data flow rules considered in a previous iteration of program function140(step708). A contradiction exists where one rule permits a certain data flow and another rule denies this same data flow. This check is made by comparing each rule against each other rule. Next, program function140compares the first data flow rule in table514for any other type of misconfiguration such as “superset” redundancy where one rule encompasses another rule, making it unnecessary to include this other rule in the rule set (step710). As another example of processing in step710, program function140checks if the source IP address is not reachable from the source zone of any firewall interface, making it impossible for this rule to apply. As another example of processing in step710, program function140checks if the destination IP address is not reachable through a destination zone for any interface of the firewall, making it impossible for this rule to apply. These other types of potential misconfigurations are listed in the misconfiguration database703.

For each zone inconsistency, rule redundancy, rule contradiction, or other type of misconfiguration (decision720, yes branch), program function140writes the rule into a misconfiguration table730(step732). If the current rule has no zone inconsistency, rule redundancy, rule contradiction, or other type of misconfiguration or after step732, program function140loops back to step704to evaluate the next rule in data flow checking table514(decision740, no branch), i.e. repeats the foregoing steps704,706,708,710,720,732and740. After all the rules have been evaluated (decision740, yes branch), then program function140has completed its evaluation, and proceeds to step802to invoke program function150.

FIG. 8illustrates program function150in detail. As explained above, program function150determines errors in other firewall settings unrelated to data flow rules, such as settings related to an SNMP function (for notification and management of events) and administration of the firewall21. For example, program function150determines usage of improper keys in SNMP, absence of default keys for SNMP, and improper length to SNMP password strings (to access files within the firewall). Program function150also determines whether there is proper specification of what information should be logged, whether banners indicating that the network is secure should be displayed, and whether the administrator must authenticate himself or herself to an authentication server before obtaining access to the firewall. Then program function150compares this information for the first setting to a list of improper settings maintained in findings database810(step804). These improper settings were previously entered into database810. If the actual setting matches an improper setting (decision806, yes branch), then program function150writes the improper actual setting into an improper actual setting database830(step832). If the first one of the settings was proper (decision806yes branch) or after step832, if there is another actual setting to evaluate (decision836, no branch), program function150loops back to step804to review the next actual setting, as described above. After all the actual settings have been evaluated, program function150has completed its evaluation, so it invokes program function160at step902.

FIGS. 9(A) and 9(B)illustrate program function160in detail. As explained above, program function160controls a computer display to graphically present the data flows, vulnerabilities and misconfigurations in a manner which effectively shows the vulnerabilities and misconfigurations to the user. In step902, program function presents to a user four different options for display.

The first option (leading to branch905) is to display a network diagram illustrating the various firewalls, interfaces and networks/zones with the type of each network/zone indicated by blue, green, yellow or red coloration or other representative color coding of a network icon. In the illustrated example, each network icon is a “cloud”. The network diagram also indicates for each interface, adjacent to the interface, a list of the permitted (or “active”) port types, port numbers and by arrow, the direction of the permitted communication through each port. The network diagram also indicates for each firewall, the total number of problematic rules of each type, i.e. data flow vulnerabilities, data flow misconfigurations and improper settings.FIG. 10illustrates an example of a network diagram corresponding to a portion of the computer system ofFIG. 1, from the vantage point of firewall21, i.e. firewall21and the networks11,12and13connected to firewall21.

In the example ofFIG. 10, the three networks or “zones”11,12, and13connected to the firewall21are color-coded according to their security levels. (FIG. 10is shown in black and white pursuant to USPTO rules, although in actuality, the network icons, flow arrows and certain port numbers are colored to provide associated information.) Thus, the network icon for blue network13is colored blue, the network icon for yellow network12is colored yellow, and the network icon for green network11is colored green. Each network icon is labeled with its network, network address translation (“NAT”) information (if any), and its numerical security level. In the illustrated example, blue zone network13is a secure company intranet, green zone network11is a trusted network, red zone network21is an untrusted network such as the Internet, and yellow zone network12is a DMZ network separating the blue zone network from the untrusted, red zone Internet. As a default, when a user does not supply color information for each type of network, the color coding will correspond to a reverse rainbow, with blue being the most secure network, and red the most insecure (typically the Internet). By way of example, the blue zone network13has security level of one hundred, the green zone network11has security level of seventy, and the yellow zone network12has security level of fifty. The higher the security level, the more secure the network.

FIG. 10also illustrates a summary pie chart1035labeled with the total number of data flow vulnerabilities, data flow misconfigurations, and improper firewall settings for firewall21. Each section of the pie is labeled with the total number of findings of the corresponding type. If the user selects any of the pie sections, for example, by clicking with a mouse button, the corresponding table (seeFIGS. 11-13) will be displayed. For example, if the section labeled “Firewall Settings Four” is clicked, then a firewall settings table would be displayed such as the one illustrated inFIG. 13. In this example, the displayed firewall settings table has four improper firewall setting entries in all.

FIG. 10also illustrates two sets of port numbers adjacent to each network; one set specifies the inbound ports used by this network to receive a communication from other networks, and the other set specifies the destination ports specified in communications from this network to other networks. These ports are the ports of a network device which receives the communication, for example, a web server, a database server or a mail server. In operation, firewall21reviews the port specified in each communication sent to the firewall en route to the destination network, and filters that communication if specified in the associated firewall rule. In the illustrated example, network13uses port numbers22,23,25and123to receive communications from other networks, and sends communications to port numbers23,80and443of other networks. Network12uses port number23to receive communications, and sends communications to port numbers22,25,80and123of other networks. Network11uses port numbers23,25,80and443to receive communications, and sends communications to port numbers23and123of other networks. The port numbers on each port list are color-coded according to the severity of the associated vulnerability finding made by program function130. A black number has no associated vulnerability. A green number is a low vulnerability, a yellow number is medium vulnerability, and a red number is high vulnerability. The same port number may have different vulnerability ratings depending on the direction of flow, host-to-host limitation, or other factors. For example, allowing an ntp communication from any host in one zone to any host in a higher-security zone is typically more dangerous (and therefore rated as a higher vulnerability) than allowing the NTP communication from one designated ntp server in a high-security zone to a few specific other hosts in a lower-security zone. The following is the color code in the illustrated example. Inbound port22of network13is color coded green to represent a low severity level of vulnerability. Inbound port123and destination port23of network13are color coded yellow to represent an intermediate severity level of vulnerability. Inbound ports23and25of network13are color coded red to represent a high severity level of vulnerability. Destination ports22and123of network12are color coded green to represent a low severity level of vulnerability. Inbound port23and destination port25of network12are color coded red to represent a high severity level of vulnerability. Inbound port23and destination port123of network11are color coded yellow to represent an intermediate severity level of vulnerability. Inbound port25and destination port23of network11are color coded red to represent a high severity level of vulnerability.

FIG. 10also illustrates by arrows the data flows/communications between zones. For each zone11,12and13, colored arrows represent flows into and flows out of the zone, for the corresponding sets of ports shown at the source of the arrow. The color of a flow arrow corresponds to the security of the zone which is sending the communication in the case of an inbound communication (the arrows point towards the respective network clouds), and corresponds to the security of the zone which is receiving the communication in the case of an outbound communication (the arrows point towards the firewall). In the illustrated embodiment, the ports listed next to each set of color-coded flow arrows of the same direction include all flows in that direction. Thus, if a communication is flowing to the blue zone13from any other zone, the port associated with that communication will be listed in the inbound port list for the blue zone13at the source of the incoming flow arrows. For example, if SSH (TCP port22) is allowed from yellow to blue, then the SSH port number will appear in the list of inbound ports next to the flow arrows for the blue zone13, even when SSH is not permitted to flow from the green zone to the blue zone. The following are specific examples of the arrows inFIG. 10. A yellow arrow1011pointing toward the blue zone network13represents all flows originating in the yellow zone network12and sent to one or more of ports22,23,25and123of the blue zone network13. A green arrow1013pointing towards the blue zone network13represents all flows originating in the green zone network11and sent to one or more of ports22,23,25and123of the blue zone network13. A green arrow1027pointing away from blue zone network13represents all flows originating in the blue zone network13and sent to one or more of ports23,80and443of the green zone network11. A yellow arrow1025pointing away from blue zone network13represents all flows originating in the blue zone network13and sent to one or more of ports23,80and443of the yellow zone network12. A green arrow1015pointing toward the yellow zone network12represents all flows originating in the green zone network11and sent to port23of the yellow zone network12. A blue arrow1017pointing toward the yellow zone network12represents all flows originating in the blue zone network13and sent to port23of the yellow zone network13. A green arrow1019pointing away from the yellow zone network12represents all flows originating in the yellow zone network12and sent to one or more of ports22,25,80and123of the green zone network11. A blue arrow1021pointing away from the yellow zone network12represents all flows originating in the yellow zone network12and sent to one or more of ports22,25,80and123of the blue zone network13. A yellow arrow1029pointing toward the green zone network11represents all flows originating in the yellow zone network12and sent to one or more of ports23,25,80and443of the green zone network21. A blue arrow1031pointing toward the green zone network11represents all flows originating in the blue zone network13and sent to one or more of ports23,25,80and443of the green zone network11. A yellow arrow1033pointing away from green zone network11represents all flows originating in the green zone network11and sent to one or more of ports23and123of the yellow zone network12. A blue arrow1023pointing away from green zone network11represents all flows originating in the green zone network11and sent to one or more of ports23and123of the blue zone network13. (In an alternate embodiment of the present invention, for each arrow into each zone/network there is a separate list of ports, shown at the source of the arrow, used for the communication represented by the arrow.)

To see a list of the ports/services used from one specific zone to another, for example only ports/services flowing from the yellow zone12to the blue zone13, the user can scroll over the respective colored arrow(s), in this example, arrow1011. As the mouse passes over the arrow, a box will pop up with a list of only the ports/services flowing between the two zones represented by the arrow.

In order to examine the security findings for flows between two zones in more detail, the user may click on a flow arrow. A window, such as pop up window1101, will pop up with a list of vulnerable ports/services and the vulnerability information corresponding to each flow. The vulnerability information for a flow includes a description of the finding, (such as shown in pop up window1101), the relevant line number(s) from the configuration file304, recommendations for the administrator, and other information. To access vulnerability information for one specific port/service, the user may click on a colored port number in any port list. A window will pop up containing the vulnerability information for that flow only. The vulnerability information for a specific port/service includes the same information described above.

Each security zone may have non-dataflow features that can be determined from the loaded configuration file304. These features may include routing information, the location of logging and other special-purpose servers, etc. The basic network diagram does not display this information. However, if the user wishes to examine these additional features, the user may click on the network icon (cloud) to bring it into “focus.” When a network is in “focus”, all such additional information is graphically displayed. In the illustrated example, there is another firewall22between the yellow zone network12and the red zone network14. If the IP addresses in the red zone14are reachable through the yellow zone12, then there must be routing information for those red addresses in the configuration file304of the firewall21currently under examination. Therefore, the existence of the firewall22can be deduced from the configuration file304of the firewall21. It will appear as a router on the sample network diagram (FIG. 10) when the yellow zone12is brought into focus. If different zones are brought into focus, different information will be revealed. If, for example, the blue zone13is brought into focus (not shown), the user will see a type of authentication server and its IP address attached to the blue zone13.

Referring again toFIG. 9(A), the second option (branch940) is to display a table which lists each of the rules in the ruleset for a specified firewall, and the rules which represent data flow vulnerabilities.FIG. 11illustrates an example of a vulnerability table for firewall21. (FIG. 11is shown in black and white pursuant to USPTO rules, although in actuality, some of the entries as described below are colored to provide associated information.) The Rule Number column identifies the order in which the rules are processed by the firewall. For each of the rules there is an entry for (a) security rating, (b) rule number, (c) source IP address for the data flow, (d) destination IP address for the data flow, (e) IP protocol, (f) port and (g) rule action. For each rule, the entry for the source IP address is color coded indicating the type of source network/zone, for example, blue, green, yellow or red. (If the type of source network for the source IP address is not limited, then the entry for the source IP address is “any” and is not color coded to indicate all networks connected to the firewall.) In the example, the source IP addresses for rules1,2,3,10,11and13are color coded blue, the source IP addresses for rules5,9and12are color coded yellow, and the source IP addresses for rules6and14are color coded green. Likewise, for each rule, the entry for the destination IP address is color coded indicating the type of destination network/zone, for example, blue, green, yellow or red. In the example, the destination IP addresses for rules1,2,3,9and12are color coded blue, and the destination IP addresses for rules4,6,7,8,10,11,13and14are color coded yellow. For any of the rules for which program functions130has identified a vulnerability problem, the rule number is highlighted to indicate a hyperlink, the security rating entry is listed as high, medium or low and color coded red, yellow or green, respectively, to indicate the severity of the problem. In the example, rule numbers4,5,9and12are color coded blue, and have color coded security rating entries. The Protocol column refers to protocols within the IP suite. The most common IP suite protocols used are TCP, UDP and ICMP. The Rule Action column identifies if the communication flow is being allowed or denied.

Rules that have a vulnerability have a hyperlink that when clicked pops up a window that provides an explanation of the vulnerability. If the user selects any of these rule entries, for example, by clicking with a mouse button, program tool160displays additional information about the rule and a recommendation on how to fix a vulnerability problem, if any, associated with the rule. In the example ofFIG. 11, the user has clicked on “Rule5”, and in response, pop up window1041is displayed. The additional information comprises a description of vulnerability and mitigation recommendations. Examples of recommendations are as follows: remove rule, rewrite rule, upgrade patch level, use alternate protocol(s). The additional information about each type of problem and the recommendation of how to fix each type of problem were previously entered into a recommendations database950.

Referring again toFIG. 9(A), the third option (branch160) is to display a table which lists each of the rules in the ruleset for the firewall, and also indicates the rules which represent data flow misconfigurations.FIG. 12illustrates an example of a misconfiguration table for firewall21. (FIG. 11is shown in black and white pursuant to USPTO rules, although in actuality, some of the entries as described below are colored to provide associated information.) The Rule Number column identifies the order in which the rules are processed by the firewall. For each of the rules there is an entry for (a) security rating, (b) rule number, (c) source IP address for the data flow, (d) destination IP address for the data flow, (e) IP protocol, (f) port and (g) rule action. The table displays the complete ruleset and identifies all rules that have been found to have rule inconsistencies, contradictions and redundancies. The Security Rating column gives a rating of each configuration issue identified. These ratings are based on what effect the rule has on the network. For any of the rules for which program function140has identified a data flow configuration problem, there is an “low”, “medium” or “high” entry for the security rating, and color coding of the security rating entry indicating the severity of the configuration problem, for example, green, yellow or red, respectively. The lower the security rating, the lesser the effect on the network caused by the misconfiguration. For any of the rules for which program function140has identified a data flow configuration problem, there is also highlighting of the respective rule number to indicate a hyperlink. In the example, rules3,7,8,10,13and14have been highlighted. Rules that have a misconfiguration have a hyperlink that when clicked pops up a window that provides an explanation of the misconfiguration. If the user selects any of these rule entries, for example, by clicking with a mouse button, program tool160displays additional information about the rule and a recommendation on how to fix the problem. In the example, the user has clicked rule8, and in response, a pop up window1051has been displayed. The additional information comprises a description of the vulnerability and mitigation recommendations. Examples of recommendations are as follows: remove rule, rewrite rule, upgrade patch level, use alternate protocol(s). The additional information about each type of problem and the recommendation of how to fix each type of problem were previously entered into the recommendations database950. The entries in the Source IP address(es) column and Destination IP Address(es) columns are color-coded based upon the type of their zone. The color red identifies an Internet (unknown and untrusted) network. The color yellow identifies an extranet (known but untrusted, i.e. semi-secure) network. The color green identifies a protected extranet (known and semi-trusted) network. The color blue identifies an intranet (known and trusted) network. In the example, the entries for the source IP addresses for rules1,2,3,8,10,11and13are color coded blue, the entries for the source IP addresses5,7,9and12are color coded yellow, and the source IP addresses for the entries for rules6and14are color coded green. In the example, the entries for the destination IP addresses for rules1,2,3,9and12are color coded blue, and the entries for the destination IP addresses4,6,7,8,10,11,13and14are color coded yellow. Thus, in this example, rules7,8,10,13, and14create inconsistencies, contradictions and redundancies between rules. However, because the rules create minimal effect, if one rule denies a host access, but a later rule allows the same host access, this would be considered a low security rating. Likewise, redundant rules would be considered a low severity level. In this example, rule3is considered a medium risk because it allows access to the firewall on TCP port49. Firewall rules should never allow flows to the firewall with the exception of management communications. The Protocol column refers to protocols within the IP suite. The most common IP suite protocols used are TCP, UDP and ICMP. The Rule Action column identifies if the communication flow is being allowed or denied.

Referring again toFIG. 9(B), the fourth option (branch980) is to display a table which lists each of the (nondataflow) settings for the firewall.FIG. 13illustrates an example of a firewall settings table for firewall21. The firewall settings table identifies the security rating of each firewall setting and whether the firewall setting is improper. The Security Rating column gives a rating of each setting which is identified. There are three types of security ratings, Low, Medium, and High. For any of the settings for which program functions140has identified as improper, there is a “high”, “medium” or “low” entry for the security rating, and color coding of the security rating entry indicating the severity of the problem, for example, red, yellow or green, respectively. These ratings are based on impact of and difficulty to exploit the setting. A typical low rating, color-coded in green, would have minimal impact on the firewall. InFIG. 13, the example firewall setting, “Outside interface security level 100, Inside interface security level 0,” is actually improper but has a low rating, assuming the rules associated with each interface are correct. This is because the rules govern the access through the interface. A typical medium setting, color-coded in yellow, would have moderate impact on the firewall. InFIG. 13, the example firewall setting, “SNMP community “SNMPkey,” is considered a medium setting because it would allow an attacker to easily guess the community string and gain SNMP access to the firewall. A typical high setting, color-coded in red, would have substantial impact on the firewall. InFIG. 13, the example firewall setting, “Logging buffered notifications,” is considered a high setting because the firewall logs are buffered on the firewall. When the buffer fills up, the buffer starts to write over older logs. Such overflow prevents a good history of events and an accurate record in case a computer forensics investigation is required.

Each rating has a hyperlink that when clicked pops up a window that provides an explanation of the configuration setting and recommendations. If the user selects any of the settings entries, for example, by clicking with a mouse button, program tool160displays additional information about the setting and a recommendation on how to fix the problem. In the example, the user has selected the upper entry, and in response, a pop up window1061has been displayed. The additional information comprises a description of the vulnerability and mitigation recommendations. Examples of recommendations are as follows: reconfigure SNMP to use private strings, use the authentication to access firewall management, and turn off unnecessary services. The additional information about each type of problem and the recommendation of how to fix each type of problem were previously entered into database950. After presenting the options to the user in step902, the user selects one of the options in step904.

Referring again toFIG. 9(A), if the user selects the option to display the network diagram (branch905), program function160reads the zone table404to determine which firewall(s) and their interfaces interconnect which networks/zones (step906). Program function160has in storage, (a) a predetermined “cloud” icon to represent each network/zone, (b) a predetermined firewall icon to represent each firewall in the composite network, and (c) a predetermined connector line to connect each firewall to the networks/zones which it interconnects. From the zone table information and using the predefined icons and a graphical knowledge base to layout the cloud icons so they do not overlap one another and are adjacent to their respective interfaces, program function160generates the portion of the network diagram illustrating the interfaces and their respective networks/zones (step910). Also from the zone table404, program function160learns the security level of each zone, and then color codes the zone icon accordingly, i.e. blue, green, yellow or red (step914). Next, program function160reads the data flow checking table514to determine the ports used for communication through each firewall to and from the respective networks/zones (step915), and the direction of each data flow (step916). Program function160uses this information to list the port numbers adjacent to the displayed firewall icons and generate arrows indicating the direction of the permitted communication through the ports (step920). Next, program function160reads the data flow misconfiguration database730and found vulnerability database610and improper actual setting database830to determine the total number of findings (step922). Then, program function160displays these numbers adjacent to the respective firewall (step924) in the form of pie chart1035. Finally, program function160displays the resulting network diagram on display screen49to the user (step930).

Refer again to step904where the user selects a display option. If the user selects the option to display the data flow vulnerability table (branch940), program function160reads the data flow checking table514to determine the data flows permitted through each interface (step942). For each permitted data flow, the data flow checking table514indicates the source IP address, destination IP address, firewall interface, protocol, port, rule action and direction of data flow through the interface. Then, program function160begins to build the vulnerability table containing, for each data flow, the rule number, source IP address, destination IP address, and rule action (step943). Then, program function160reads the zone table404to determine the security level of each of the networks/zones containing the source IP addresses and each of the networks/zones containing the destination IP addresses (step944). Then, program function160color codes the source IP address entries and destination IP address entries accordingly, i.e. blue, green, yellow and red (step946). Then, program function160reads from the configuration table the type of protocol and port number used for each of the data flows and adds the protocol and port number to the vulnerability table (step948). Then, program function160reads the found-vulnerability database610to determine which of the rules pose a vulnerability (step950). Then, program function160assigns to each vulnerable rule a severity level based on a severity table, and color codes the protocol entry according to the severity level, i.e. red, yellow or green (step952). Finally, program function160displays the vulnerability table on display screen49(step954). If requested, program function160will also printout the information in the vulnerability table (step956).

Refer again to step904where the user selects a display option. If the user selects the option to display the misconfiguration table (branch960), program function160reads the data flow checking514to determine the data flows permitted through each interface (step962). For each permitted data flow, the data flow checking table514indicates the source IP address, destination IP address, firewall interface, protocol, port, rule action and direction of data flow through the interface. Then, program function160begins to build the misconfiguration table containing, for each data flow, the rule number, source IP address, destination IP address, protocol, port and rule action (step963). Then, program function160reads the zone table404to determine the security level of each of the networks/zones containing the source IP addresses and each of the networks/zones containing the destination IP addresses (step964). Then, program function160color codes the source IP address entries and destination IP address entries accordingly, i.e. blue, green, yellow and red (step965). Then, program function160reads the misconfiguration database730to determine which of the rules represent a misconfiguration (step967). Then, program function160assigns a severity level to each misconfiguration based on a severity table, and color codes the protocol entry according to the severity level, i.e. red, yellow or green (step968). Finally, program function160displays the misconfiguration table on display screen49(step970). If requested, program function160will also printout the information in the misconfiguration table (step972).

Refer again to step904where the user selects a display option. If the user selects the option to display the firewall settings (branch980), program function160reads the actual improper settings database830to determine the actual improper settings within the firewall (step982). For each improper setting, program function160begins to build an improper settings table indicating a description of the actual improper setting (step984). Then, program function160reads the improper settings database810to determine a severity level of each improper actual setting (step986). Then, program function160color codes the entry in the improper settings table according to the severity level, i.e. red, yellow or green (step988). Finally, program function160displays the improper settings table on display screen49(step990). If requested, program function160will also printout the information in the improper settings table (step992).

The form of each of the tables which is printed out in steps956,972or992may differ from that which is displayed. If the printout is requested, program function160converts the reference table used for the display into the printout form, prints it out and displays the printout as well.FIG. 14illustrates an example of a printout of vulnerability findings for firewall21, and includes for each vulnerable flow, the security rating for the vulnerability, the number of the rule that causes the vulnerability, the source IP address and destination IP address of the vulnerable flow, the network port and protocol of the vulnerable flow, and the recommendation to mitigate the vulnerability.FIG. 15illustrates an example of a printout of misconfiguration findings for firewall21, and includes for each misconfigured rule, the security rating for the misconfiguration, the number of the rule that causes the misconfiguration, the source IP address and destination IP address of the misconfigured flow, the network port and protocol of the misconfigured flow, whether the flow is permitted, and a description of the misconfiguration including where appropriate a recommendation to mitigate the misconfiguration.FIG. 16illustrates an example of a printout of improper settings of firewall21, and includes for each improper setting, the security rating for the improper setting, a description of the setting, an explanation of the problem caused by the setting, and a recommendation to correct the setting.

Based on the foregoing, a system, method and program for identifying and displaying data flows, vulnerabilities, misconfigurations and improper settings have been disclosed. However, numerous modifications and substitutions can be made without deviating from the scope of the present invention. For example, the foregoing process ofFIGS. 3-9(A)and9(B) can be repeated for firewall22. Also, the foregoing process can be repeated for routers or other stateless and/or stateful inspection devices. Also, the foregoing process can be repeated for a set of firewalls to represent holistically, the enterprise wide firewall data flow and vulnerability status. Therefore, the present invention has been disclosed by way of illustration and not limitation, and reference should be made to the following claims to determine the scope of the present invention.