Re: Rule management process

Bret and Matthew,

I have done some work in this area. Items ii and iii are largely  
mechanical processes that require firewall management skills. The  
real problem is the first item. Most of this work involved comparing  
the rules with risk assessments, policy, current threat environment  
and security posture of the organization. You will have to define all  
of these in some detail and understand where they relate directly to  
the rules. That is a big task and more complex than the other two.

Good Luck

Park Foreman
CISSP, ISSAP, CCSE
park4man@mac.com

NOTICE: This email is confidential, privileged and intended only for  
the stated addressee(s).

If you receive this in error, please inform me immediately and delete  
it and all copies from your system. Any unauthorized disclosure, use,  
or dissemination, either whole or partial, is prohibited.

This email and its attachments are believed to be free of any virus,  
or defect, but it is the responsibility of the recipient to ensure this.

On Oct 17, 2005, at 8:55 AM, Bein, Matthew wrote:

> Funny, I was just about to post the same thing.. Has anyone sent you a
> response?
>
> Matthew
>
> -----Original Message-----
> From: Bret Watson [mailto:lists@ticm.com]
> Sent: Wednesday, October 12, 2005 9:41 AM
> To: security-management@securityfocus.com
> Subject: Rule management process
>
> Hi All,
> we are in the last stages of our SSE-CMM lvl1 process improvement.
> One last thing I'm a little stuck on is developing a process for
> ensuring our rule set is i. sensible, ii. optimised and iii. does not
> have unused rules.
>
> Has anyone else done something like this ?
>
> Thanks