A Novel Concept of Firewall-Filtering Service Based on Rules Trust-Risk Assessment

Abstract

The importance given to firewalls as a security mechanism for protecting sensitive and private infrastructures has been well justified in literature. Nowadays, we consider firewalls as one of the most important security mechanisms that is widely deployed and highly approved. The main goal of this fundamental security component is to provide a filtering service by blocking or providing access to specific areas and segments of a network based on a set of filtering rules defined with regards to the global security policy. Hence, the effectiveness of the protection provided by a firewall is governed by the efficiency of the filtering policy deployed in that firewall. To enhance the quality of the filtering service provided by firewalls, we propose a novel filtering technique that integrates a risk assessment approach to evaluate the risk associated to firewalls rules. Our goal is to strengthen the filtering service with pertinent information relative to rules risk values that allows (i) changing the actions associated to critical rules in specific/critical contexts or (ii) dynamically injecting new rules in the firewall that refine other rules (by giving precision or reducing domains) to reduce the risk or (iii) changing the behavior of the firewall by changing its configuration (the set of rules) to avoid malicious scenarios.