Firewalls Deep Dive

NGFW Rule Example (Palo Alto style):

Rule Name: "Allow HR to Salesforce"
Source Zone: internal
Source User: HR-Users (group)
Source IP: 10.0.50.0/24
Destination Zone: internet
Destination IP: salesforce.com
Application: salesforce-base
Service: ssl (443)
Action: Allow
Log: Allowed traffic
Profile: vulnerability-protection, anti-malware, url-filtering

WAF Protects Against:
  └─ SQL Injection (SQLi)
  └─ Cross-Site Scripting (XSS)
  └─ Cross-Site Request Forgery (CSRF)
  └─ Remote File Inclusion (RFI)
  └─ Local File Inclusion (LFI)
  └─ Parameter tampering
  └─ Brute force login attempts
  └─ DDoS at application layer

Examples: AWS WAF, Cloudflare WAF, ModSecurity, F5 ASM, Imperva

{
  "IpPermissions": [
    {
      "IpProtocol": "tcp",
      "FromPort": 443,
      "ToPort": 443,
      "IpRanges": [{"CidrIp": "0.0.0.0/0", "Description": "HTTPS from internet"}]
    },
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "IpRanges": [{"CidrIp": "10.0.100.0/24", "Description": "SSH from admin subnet"}]
    },
    {
      "IpProtocol": "-1",
      "UserIdGroupPairs": [{"GroupId": "sg-12345"}],
      "Description": "All traffic from web tier"
    }
  ]
}

Rule Base Layout (Palo Alto firewall):

Order 1-10: Antivirus / Threat Prevention (auto-generated)
Order 11:  [INFRASTRUCTURE] Allow DNS (DNS servers → internet)
Order 12:  [INFRASTRUCTURE] Allow NTP (all servers → time.cloudflare.com)
Order 13:  [ADMIN] Allow RDP/SSH (admin jump box → all servers)
Order 14:  [BUSINESS] Allow HTTPS (web servers → database servers :3306)
Order 15:  [BUSINESS] Allow LDAP (app servers → AD domain controllers)
Order 16-25: Business application rules
Order 26:  [DENY] Block known malicious IPs (threat intel feed)
Order 27:  [DENY] Block high-risk countries (if no business there)
Order 28:  [LOG] Log all remaining traffic
Order 29:  [DENY] Default-deny — catch-all (LAST RULE)

1. Be Specific — Use source/dest zones, IPs, ports, applications
   ❌ Allow any any any
   ✅ Allow internal_zone → dmz_zone tcp/443 (web servers)

2. Least Privilege — Only open what's needed
   ❌ Allow web_servers to database_servers any any
   ✅ Allow web_servers to database_servers tcp/3306 (specific DB port)

3. Group Similar Rules — Order by function
   ❌ Random order of infrastructure, business, admin rules
   ✅ infrastructure_rules → admin_rules → business_rules

4. Block by Default — Change unused rules to deny
   ❌ Rules exist for decommissioned apps
   ✅ Remove or disable unused rules

5. Log + Monitor — Log denies, review rule hits
   ❌ No logging on deny rules
   ✅ Log all denies, track rule hit count

6. Review Regularly — Quarterly rulebase audit
   ❌ No review process
   ✅ Annual full review, quarterly hit count analysis

Attack Path:
  1. Attacker gains initial access via compromised credentials
  2. Firewall rules were overly permissive — allowed broad access between segments
  3. Once inside, attacker moved laterally to the background investigation database
  4. No firewall segmentation between the web tier and the database tier
  5. Data exfiltrated over 12+ months before detection

Aftermath:
  - Total cost: $500M+ in remediation, credit monitoring
  - Director of OPM resigned
  - Congressional hearings on federal IT security
  - Firewall rules tightened across all federal agencies

Rule Lifecycle Management:

  Create:
    - Define business justification
    - Specify source/dest/app/protocol
    - Set expiration/review date
    - Assign owner

  Test:
    - Deploy in monitor-only mode first (log but don't block)
    - Verify no legitimate traffic is affected
    - Review logs for 7 days before enabling enforcement

  Enable:
    - Set to enforce
    - Monitor initially for false positives

  Review (Quarterly):
    - Check rule hit count (remove zero-hit rules)
    - Verify source/dest/ports still valid
    - Check for shadow rules
    - Update documentation

  Decommission:
    - Remove immediately when systems are decommissioned
    - Never leave orphan rules