4

At my workplace only the security team have access to see the rules on the server network firewalls.

Developers and system engineers don't have any visibility, so they just deploy applications to servers and find out what's broken rather than checking application requirements against the rules in advance.

Is this kind of secrecy a normal/valid security practice?

Improve this question
5
  • 4
    When developing applications it is very important that developers know the restrictions for the application. Even if the firewall rules should be secret, not sharing information about this may lower productivity of developers, which is key to a successful business.
    – Aulis Ronkainen
    Jun 13, 2018 at 3:59
  • 1
    It will be better if rules are kept a secret to the outside world and known to the inside, especially to the developers.
    – Ugnes
    Jun 13, 2018 at 4:02
  • 1
    Normal practice is for developers and engineers to understand their application's network requirements, and to work with security or networking to enable the necessary connectivity in advance. Doing a blind deploy to figure out what's broke suggests a level of sloppy that usually leads to Security hostility.
    – gowenfawr
    Jun 13, 2018 at 11:29
  • For what reason would the developers need access? Why can they simply not request if there is a rule present to allow something? And if there isn't they can request it's added.
    – user173641
    Jun 13, 2018 at 13:58
  • The problem we have is that the security team has never documented or explained to anyone else what the default rules are or how developers and engineers should interact with them in defining requirements. So some cases work with no need to request anything from security and some don't.
    – user75247
    Jun 13, 2018 at 20:56

3 Answers 3

Reset to default
4

It is normal that the only people with access to view and review the network rules are the network engineers and the security team.

The development team should know what ports and protocols are required to use their applications and work with the networks team to ensure the appropriate rules are in place. If there are standard ports in use by other applications, these might be re-used. Otherwise, when making changes for testing or deploying to prod, the applications team (or product owner etc) should coordinate with the networks team. The security team should be reviewing the change request to ensure no vulnerabilities are introduced.

Improve this answer
2
  • 1
    The answers have clearly established it is a normal industry practice, which is what I was wanting to know, so thanks for that. What I don't understand is that since the rules are the result of accumulated input from engineers and developers, what security goal is achieved by preventing those people seeing them?
    – user75247
    Jun 13, 2018 at 21:09
  • It's part of Role Based Access Control and Principle of Least Privilege for users in general. They should have access to the tools and information required to perform their jobs. Any potentially sensitive security configurations or operations are only relevant to restricted, privileged individuals. While it may be appropriate to share a subset of relevant rules with the developers, knowledge of the full ruleset is in no way required for their purpose and will disclose configurations they could leverage with malice.
    – AndyMac
    Jun 14, 2018 at 14:29
1

It is normal. The rules have to be documented, but no other teams should know them.

Developers and system engineers may request for rules to be added (or removed if no longer needed) and that's more than enough.

This is a very good security practice and should remain so.

Improve this answer
0

Yes, this is normal, because:

  1. the set of rules changes in time, including some ad-hoc ones - it would be very hard to translate them to human-readable form just for documentation,
  2. the ruleset might be simply huge and also unreadable as a simple technical dump,
  3. some of the rules might be "smart", i.e. it might be really hard to give exact condition when they fire - I'm referring here to some Deep Packet Inspection/IDS rules, IP firewall rules are usually deterministic.
  4. there might be open holes in single firewalling device, blocked at some next layer. Exposing the ruleset makes it much easier to exploit.
  5. the developers need to request inserting not the rule, but the effect: I need A running with B, make me a path, not insert a rule between 234 and 235 to pass though TCP src port 5548 to 9842. This is another reason they shouldn't know the ruleset itself, as they would be deceived to repeat XY problem.

In this question you're asking if it is OK that someone has taken a photo of keys to your home (even without sharply visible pins). This isn't immediate threat, but might expose some sensitive informations - for example the producer and version of a lock, which might be vulnerable to some attack.

Improve this answer
11
  • 1
    Taking a photo of keys isn't even nearly the same: keys are simple to reproduce from a picture. Actually, that would be more like taking a screenshot of your private SSH keys...
    – ilkkachu
    Jun 13, 2018 at 6:56
  • Locks opened by keys, that are easy reproducible from a picture, are easy opened without any keys. I was talking about "patented" locks.
    – Tomasz Pala
    Jun 13, 2018 at 7:29
  • 2
    Well, keys pretty much rely on the biting being secret, anyone who can copy the key, can get in. Firewall rules don't have anything like that: knowing the rules doesn't let one automatically bypass them. At most, it might help in finding an exploit, as you said.
    – ilkkachu
    Jun 13, 2018 at 7:38
  • Good keys are multi-sided and the pits are not so easy to measure on a photo. Good locks require high key precision. With simple, 1D keys, yes - uncovering any single pit easies opening the lock with a pin.
    – Tomasz Pala
    Jun 13, 2018 at 12:50
  • 1
    Your post is implying you would have to either: print the rules off, put them in a word document, copy them to a text-file that is not the case at all. Most firewalls support read-only access not to mention they're not really that difficult to read at all, in fact, they're pretty self-explanatory and given the fact he is talking about giving the development teams access I am sure they're more than capable of reading firewall rules without needing them put into a "human-readable" format.
    – user173641
    Jun 13, 2018 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.