LISA '07 – Abstract
Pp. 1–16 of the Proceedings
PolicyVis: Firewall Security Policy Visualization and Inspection
Tung Tran, University of Waterloo; Ehab Al-Shaer, University of Waterloo and DePaul University; Raouf Boutaba, University of Waterloo, Canada
Abstract
Firewalls have an important role in network security. However,
managing firewall policies is an extremely complex task because the
large number of interacting rules in single or distributed firewalls
significantly increases the possibility of policy misconfiguration and
network vulnerabilities. Moreover, due to low-level representation of
firewall rules, the semantic of firewall policies become very
incomprehensible, which makes inspecting of firewall policy's
properties a difficult and error-prone task.
In this paper, we propose a tool called PolicyVis which visualizes
firewall rules and policies in such a way that efficiently enhances
the understanding and inspecting firewall policies. Unlike previous
works that attempt to validate or inspect firewall rules based on
specific queries or errors, our approach is to visualize firewall
policies to enable the user to place general inquiry such as "does my
policy do what I intend to do" unrestrictedly. We describe the design
principals in PolicyVis and provide concepts and examples dealing with
firewall policy's properties, rule anomalies and distributed
firewalls. As a result, PolicyVis considerably simplifies the
management of firewall policies and hence effectively improves the
network security.
- View the full text of this paper in HTML
and PDF.
Listen to the presentation in
MP3 format.
Until November 2008, you will need your USENIX membership identification in order to access the full papers.
The Proceedings are published as a collective work, © 2007 by the USENIX Association. All Rights Reserved. Rights to individual papers remain with the author or the author's employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. USENIX acknowledges all trademarks within this paper.
|
