Re: What should be in a firewall audit checklist?

9) Audit of the underlying operating system.
10) If the firewall has an administration console
     i) The audit of the OS of administration console.
    ii) Check if there are unnecessary accounts to manage the firewall
    iii) Check the permissions of the accounts.
    iv) Check if the console has time - out property

11) Audit of NAT rules
12) Audit of IPS rules (if any)

----- Original Message ----- 
From: "Doug Fox" <dfox168@hotmail.com>
To: "FireWall-1 Gurus Mailinglist" <fw1-gurus@lists.phoneboy.com>;
<firewalls@securityfocus.com>
Sent: Sunday, November 27, 2005 12:26 AM
Subject: What should be in a firewall audit checklist?


> A friend asked me to audit his firewall at work.
> Honestly, I have no clue even though googled for many days.
>
> In this context, I am planning to audit the firewall as follows:  Any
> comments/suggestions are welcome.
>
> 1) The placement or location of the firewall
> 2) Vulnerability scanning the firewall from outside, e.g., Internet
> 3) The rulebase or security policy according to its vendor recommendation
> 4) I will also check the access control (ID, password and priviledges) to
> the system.
> 5) physical security of the system
> 6) Monitoring of the firewall log, to find out if any port scanning or
> hacking activities
> 7) Rulebase Change Control
> 8) documentation
> 9) Please generously point out the missing pieces as you see it.
>
> Any input/comments are greatly appreciated.
>
> Thanks,
>
> Doug