What Is a Firewall Security Audit and Why Do Universities Need One?

What Is a Firewall Security Audit?

A firewall security audit will begin with discovery of all firewall platforms, including associated device configurations, policy sets and features.

It will then identify risks, with clear recommendations around configuration updates, support status, operational performance and identification of single points of failure. Finally, the audit will review existing management or monitoring processes.

Click the banner below to learn how managed security services can optimize cyberdefense.

“It’s an annual health check for the gates that are protecting your digital campus,” says Fadi Fadhil, field CIO for state, local and education at Palo Alto Networks. “You’re basically validating that the policies and the guidelines and the guardrails are in place, so they match your current risk posture, business goals and threat landscape.”

Why Colleges and Universities Need Regular Firewall Audits

The ever-evolving nature of cyberthreats and the IT ecosystem drives the need for regular firewall audits in higher education. “Things change,” says Aaron Rose, security architect manager at Check Point Software.

“The threat landscape is changing constantly, so you need to go back and review that to understand, is my policy still aligned with whatever the current threat landscape is?” he says. The school itself is likely changing as well. “New students are coming in; new applications are being used every single day.”

Regulatory shifts also can impact the security posture. “Things like FERPA or GLBA, all of those types of regulations may change over time, or at least the interpretation of them,” and those changes can require adjustments to the firewall policies, Rose says.

Changes on the IT side, in particular, create the need for firewall audits. “You’ve got the IoT devices and the OT devices, you’ve got the labs and even student gaming traffic,” Fadhil says. As those needs evolve, outdated rules create vulnerabilities. Even if a rule was written just six months ago, “it could be obsolete — or worse, it could be exploitable.”

Finally, an audit helps ensure a university is getting maximum value out of its firewall investment. Firewall vendors are constantly releasing new features, “but you need to make sure that those rules are configured correctly, that your firewall is configured correctly, to utilize those new capabilities,” Rose says.

Common Gaps Revealed During a Firewall Audit/Assessment

A firewall audit will likely surface gaps in a university’s defenses. In reviewing configurations, “the No. 1 thing we find are rules that are sitting in there that have never been used or that haven’t been used in years,” Rose says.

“It’s going to find rules that are redundant,” he says, or it may spot rules that likely to cause risk, such as “opening up a specific port for a specific application that’s no longer used.”

Fadhil also points to “overly permissive rules” as the mostly likely finding in a firewall audit report. “I like to call it an ‘any-any policy,’” he says. “Anyone can have access to anything. Any employee, as long as they worked for this department at some point, can have access to any resource that that department has access to.”

The audit also may identify “ghost rules,” outdated policies that are no longer relevant and can create vulnerabilities. It may spot places where misconfigurations generate risk, and it can also detect “a lack of application layer control, where you are allowing traffic by port instead of by actual application identity,” Fadhil says.

RELATED: Effective artificial intelligence requires effective data governance.

The Role of Trusted Partners in Performing Firewall Health Checks

Colleges and universities need trusted partners to conduct effective firewall audits. A partner will have access to comprehensive technical and lifecycle services and vendor resources, along with the ability to architect, implement and support complex network environments.

A partner can extend the capabilities of thinly stretched IT organizations. In higher education, “institutions can reduce human resource needs by working with third parties” in support of effective firewall use, EDUCAUSE reports.

That’s a big benefit. “Security teams in higher education are often very lean. When you work with a trusted partner, you’re getting a force multiplier,” Fadhil says.

As a college or university IT leader, “you’re wearing a thousand hats,” he says. “You’re worried if you’re doing everything right, you’re probably overworked, and you’re responsible for something this huge and this important. When you can get industry to help you out, the impact is huge.”