This Stage is designed to test the Operating System Security as applied to the Firewall. If the underlying system security is inadequate an attacker may be able to compromise the firewall by logging on as a valid user and replacing the configuration. As the firewall gateway is only a part of the overall picture, we review the Security of the networks adjacent to the firewall.
Any firewall is only as good as the policy it runs.
The Servers that are being protected by a firewall are often vulnerable to attack even with a firewall. One example of this would be an NT based web server with the IIS admin interface available to the world. The firewall does not defend against server miss-configurations. Finally all the information gathered is used to construct an attack matrix to test and rate the installation. All details, vulnerabilities and recommendations are documented for your future reference.