Patent ID: 7937353

Claim:
A computer-implemented method to determine whether to alter a firewall configuration, said method comprising: a computer receiving message flow data associated with a message packet that was blocked by a firewall based on the firewall not having a message flow rule which permitted passage of said message packet, said message flow data identifying a source network associated with said message packet, a destination network associated with said message packet and a destination port associated with said message packet; the computer determining a first risk value and a second risk value that indicate levels of trust respectively associated with first and second zones in which said source and destination networks are respectively located, a third risk value that indicates whether said source network is authorized to be a network that is a source of said message packet in a communication session, a fourth risk value that indicates whether said destination network is authorized to be a network that receives said message packet in said communication session, and a fifth risk value that indicates whether said destination port in said destination network is authorized to be a port that receives said message packet in said communication session; and based on the first, second, third, fourth and fifth risk values, the computer determining and generating an electronic recommendation indicating whether to add to said firewall a message flow rule that permits said message flow to pass.