4

At my workplace only the security team have access to see the rules on the server network firewalls.

Developers and system engineers don't have any visibility, so they just deploy applications to servers and find out what's broken rather than checking application requirements against the rules in advance.

Is this kind of secrecy a normal/valid security practice?

|improve this question
  • 4
    When developing applications it is very important that developers know the restrictions for the application. Even if the firewall rules should be secret, not sharing information about this may lower productivity of developers, which is key to a successful business. – Aulis Ronkainen Jun 13 '18 at 3:59
  • 1
    It will be better if rules are kept a secret to the outside world and known to the inside, especially to the developers. – Ugnes Jun 13 '18 at 4:02
  • 1
    Normal practice is for developers and engineers to understand their application's network requirements, and to work with security or networking to enable the necessary connectivity in advance. Doing a blind deploy to figure out what's broke suggests a level of sloppy that usually leads to Security hostility. – gowenfawr Jun 13 '18 at 11:29
  • For what reason would the developers need access? Why can they simply not request if there is a rule present to allow something? And if there isn't they can request it's added. – J.J Jun 13 '18 at 13:58
  • The problem we have is that the security team has never documented or explained to anyone else what the default rules are or how developers and engineers should interact with them in defining requirements. So some cases work with no need to request anything from security and some don't. – user75247 Jun 13 '18 at 20:56
4

It is normal that the only people with access to view and review the network rules are the network engineers and the security team.

The development team should know what ports and protocols are required to use their applications and work with the networks team to ensure the appropriate rules are in place. If there are standard ports in use by other applications, these might be re-used. Otherwise, when making changes for testing or deploying to prod, the applications team (or product owner etc) should coordinate with the networks team. The security team should be reviewing the change request to ensure no vulnerabilities are introduced.

|improve this answer
  • 1
    The answers have clearly established it is a normal industry practice, which is what I was wanting to know, so thanks for that. What I don't understand is that since the rules are the result of accumulated input from engineers and developers, what security goal is achieved by preventing those people seeing them? – user75247 Jun 13 '18 at 21:09
  • It's part of Role Based Access Control and Principle of Least Privilege for users in general. They should have access to the tools and information required to perform their jobs. Any potentially sensitive security configurations or operations are only relevant to restricted, privileged individuals. While it may be appropriate to share a subset of relevant rules with the developers, knowledge of the full ruleset is in no way required for their purpose and will disclose configurations they could leverage with malice. – AndyMac Jun 14 '18 at 14:29
1

It is normal. The rules have to be documented, but no other teams should know them.

Developers and system engineers may request for rules to be added (or removed if no longer needed) and that's more than enough.

This is a very good security practice and should remain so.

|improve this answer
0

Yes, this is normal, because:

  1. the set of rules changes in time, including some ad-hoc ones - it would be very hard to translate them to human-readable form just for documentation,
  2. the ruleset might be simply huge and also unreadable as a simple technical dump,
  3. some of the rules might be "smart", i.e. it might be really hard to give exact condition when they fire - I'm referring here to some Deep Packet Inspection/IDS rules, IP firewall rules are usually deterministic.
  4. there might be open holes in single firewalling device, blocked at some next layer. Exposing the ruleset makes it much easier to exploit.
  5. the developers need to request inserting not the rule, but the effect: I need A running with B, make me a path, not insert a rule between 234 and 235 to pass though TCP src port 5548 to 9842. This is another reason they shouldn't know the ruleset itself, as they would be deceived to repeat XY problem.

In this question you're asking if it is OK that someone has taken a photo of keys to your home (even without sharply visible pins). This isn't immediate threat, but might expose some sensitive informations - for example the producer and version of a lock, which might be vulnerable to some attack.

|improve this answer
  • 1
    Taking a photo of keys isn't even nearly the same: keys are simple to reproduce from a picture. Actually, that would be more like taking a screenshot of your private SSH keys... – ilkkachu Jun 13 '18 at 6:56
  • Locks opened by keys, that are easy reproducible from a picture, are easy opened without any keys. I was talking about "patented" locks. – Tomasz Pala Jun 13 '18 at 7:29
  • 2
    Well, keys pretty much rely on the biting being secret, anyone who can copy the key, can get in. Firewall rules don't have anything like that: knowing the rules doesn't let one automatically bypass them. At most, it might help in finding an exploit, as you said. – ilkkachu Jun 13 '18 at 7:38
  • Good keys are multi-sided and the pits are not so easy to measure on a photo. Good locks require high key precision. With simple, 1D keys, yes - uncovering any single pit easies opening the lock with a pin. – Tomasz Pala Jun 13 '18 at 12:50
  • 1
    Your post is implying you would have to either: print the rules off, put them in a word document, copy them to a text-file that is not the case at all. Most firewalls support read-only access not to mention they're not really that difficult to read at all, in fact, they're pretty self-explanatory and given the fact he is talking about giving the development teams access I am sure they're more than capable of reading firewall rules without needing them put into a "human-readable" format. – J.J Jun 13 '18 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.