# Firewall Configuration Errors Revisited

## TL;DR

This study revisits a 2004 survey on firewall configuration quality, analyzing a larger dataset from two vendors and introducing a new complexity measure, confirming that firewalls remain poorly configured with complexity linked to risks.

## Contribution

It provides the first large-scale, multi-vendor analysis of firewall configurations and introduces a novel complexity metric applicable to different firewall types.

## Key findings

- Firewalls are still often poorly configured.
- Firewall complexity correlates with risk items.
- No significant error reduction in newer software versions.

## Abstract

The first quantitative evaluation of the quality of corporate firewall configurations appeared in 2004, based on Check Point FireWall-1 rule-sets. In general that survey indicated that corporate firewalls were often enforcing poorly written rule-sets, containing many mistakes. The goal of this work is to revisit the first survey. The current study is much larger. Moreover, for the first time, the study includes configurations from two major vendors. The study also introduce a novel "Firewall Complexity" (FC) measure, that applies to both types of firewalls. The findings of the current study indeed validate the 2004 study's main observations: firewalls are (still) poorly configured, and a rule-set's complexity is (still) positively correlated with the number of detected risk items. Thus we can conclude that, for well-configured firewalls, ``small is (still) beautiful''. However, unlike the 2004 study, we see no significant indication that later software versions have fewer errors (for both vendors).