# Misconfiguration in Firewalls and Network Access Controls: Literature Review
## 5 Summary  
Over the years, the different types of misconfigurations have not changed since the inception of anomaly detectors. Despite firewalls gaining more and more functionality, the types of misconfigurations have remained the same since the early 2000s. There was only one anomaly added, the flowbit misconfiguration, which is very difficult to detect. The reason for this is that these are usually configured for a very specific attack, so these misconfigurations cannot be detected without the tool knowing exactly what those rules are intended to do. As for the rest of them, additional features only increased the complexity of checking for anomalies as there are more features that need to be checked. In short, these misconfigurations are as follows:  
Shadowing is an anomaly that occurs when one rule has the same scope, or a larger encompassing scope, along with a higher priority than a second rule with a different action. This prevents the second rule from being evaluated because the first rule is triggered instead. Due to the first rule's higher priority, the second rule is never triggered under any circumstance. Correlation is when two rules with different actions have an overlapping scope but not entirely. Correlation can best be described by a Venn diagram: in the overlapping area, the higher-priority rule is enforced instead of the lower-priority rule. If you the rule order were inverted, there would be exactly the same overlap, with just a change in which rule had priority. Redundancy is when two rules with the same action have any amount of overlap. Whether the higher-priority rule entirely encompasses the scope of the second rule or if it only overlaps on one specific packet, it is redundant if the other rule also takes the same action on that traffic. Unlike other misconfigurations, redundancy has no impact on security, but extra rules slow down the performance of the firewall. Irrelevance is an anomaly in which the firewall contains rules that affects packets that cannot possibly reach that firewall. Since the particular packets cannot possibly reach the firewall, irrelevant rules therefore have no impact on security, but their presence wastes performance on the firewall. Generalization occurs when a rule with a scope that is entirely encompassed by a second rule with a different action but a lower priority. This means that every possible packet that the first rule catches would be caught by the second rule if the first did not exist. If the priority of the two rules were to be flipped, it would result in shadowing. The term \"Flowbit Misconfiguration\" is Snort-specific, but most stateful access control programs have some form of similar method of keeping track of the session state. This type of misconfiguraiton refers to an error in a rule's detection of a session state when taking an action. When session state is being taken into account in a rule, the rule is oftentimes a response to a specific type of attack. A flowbit misconfiguration refers to when the flowbit in question is incorrect, whether the session state in question is impossible, too broad, or too specific. A misconfigured flowbit, or its equivalents, can result in the specific attack it attempts to stop sneaking through or be too broad and block legitimate traffic. Very clear trends have been occurring over time. These trends follow the general development involving firewalls and networking. The growing prominence of SDN has been an influence to some extent for most of these trends such as efficiency or the type of firewall used such as an application firewall. In fact, many of these trends have influenced each other. The combination of SDN, stateful and application firewalls increased the need for efficiency, resulting in the trend of better algorithms. The major trends in anomaly detection are as follows: The transition between stateless and stateful occurred a long time ago for most projects, but stateless anomaly detection applications have not gone away entirely. Stateful firewalls do not bring new types of misconfigurations.