Automate Firewall Rule Cleanup
Overview
Tufin centralizes the management of network security enforcement points and compliance reporting
across your hybrid network.
It gives you a holistic view into your rule bases across all major firewalls—on premises and in thecloud—allowing you to automatically find and remove unused, expired and shadowed rules fromthousands of firewalls safely.

Decommissioning 18k redundant rules in one day?
A large U.S. FinServ company did just that.

Benefits• Dramatically reduce attack surface.

KEY FEATURES:
Automated rulecleanup.

See policy hygiene trends
over time.

Disable rules prior todecommissioning to
avoid causing outages.

Every change is documented
providing more granular
audit reporting.

• Save thousands of hours per year.
• Minimize firewall management
complexity, increasing agility.

• Prep for audits in hours, not weeks.

Save Time. Improve Security Posture.
Get real-time visibility into unused, shadowed, redundant and overly permissive rules and takeadvantage of automatic rule decommissioning. Tufin clients have reduced cleanup time by 80%.
(See Case Study: Large Utilities Company)“We save countless hours
on rule cleanup andcompliance reporting, andwe can give management
visibility without pulling
one of our valuable teammembers from critical tasks.”— Cybersecurity Manager,
Large U.S. Utilities Company

www.tufin.com

1© Copyright 2023 Tufin. All rights reserved.

Users can drill down from thehome dashboard to the Rule
Viewer, which makes it easy toidentify rules for cleanup. For
example, you can filter to isolate
shadowed or unused rules, oroverly permissive rules. From here
you can select rules for removal,
which automatically kicks off
a decommissioning workflow,
creating a ticket to be handled by
the appropriate team.

Automatic Identification and Decommissioningof Unused Network Objects
Tufin can automatically identify and remove duplicate,unused, or empty network groups and objects (such as
hosts, networks, or services), significantly reducing thecomplexity of managing a large enterprise network.
Users can elect to disable rules for a period of time prior
to decommissioning to ensure that removal will not cause
an outage.

Automated Workflows for Cleanup
Tufin’s customizable change workflows allow enterprises
to automate the design, risk assessment, provisioning,and verification of cleanup activities, such as ruledecommissioning and rule modification.
These workflows allow enterprises to choose the level of cleanup automation that is right for them, with approvals and manual oversight
injected at key steps, as required.
Automating the design and provisioning of cleanup activities not only saves time, it reduces errors and application downtime.
Automated risk assessments ensure that no additional risk is unintentionally introduced through policy changes, and compliance ismaintained.
Every step in the change process is fully documented, allowing instant audit of any change for compliance or in the event that a changemust be rolled back. Tufin’s automated workflows make the design, approval and provisioning of cleanup tasks fast and easy at scale.

www.tufin.com
Copyright © All rights reserved. Tufin, Unified Security Policy, Tufin Orchestration Suite and Tufin logo are trademarks of Tufin. All otherproduct names mentioned herein are trademarks or registered trademarks of their respective owners. You may not copy, reproduce,
photograph, translate, transmit ,make available to the public, make derivative works, perform in public, rent , broadcast or make any
commercial use of the publication in full and / or in part without prior written approval.

DP20230306