firewall-review

Firewall Rule Audit

A structured, repeatable process for auditing firewall rule bases against CIS Controls v8 (Control 4.4 -- Implement and Manage a Firewall on Servers, Control 4.5 -- Implement and Manage a Firewall on End-User Devices) and NIST SP 800-41 Rev 1 (Guidelines on Firewalls and Firewall Policy). This skill produces findings with traceable control references, severity ratings, and actionable remediation guidance.

---

When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

• Periodic firewall rule base reviews (quarterly or after major changes).
• Compliance audits requiring CIS Controls v8 or NIST SP 800-41 alignment.
• Incident response when lateral movement or exfiltration is suspected.
• Pre-deployment review of new firewall rule sets or policy changes.
• Network architecture reviews that include perimeter or internal segmentation firewalls.

---

Context

Firewall rule bases accumulate technical debt rapidly. Rules added during incidents are rarely removed. Temporary permits become permanent. Shadowed rules create a false sense of coverage. NIST SP 800-41 Rev 1 Section 4.2 explicitly states that firewall policies should be reviewed regularly and that rule bases should enforce a default-deny posture. CIS Controls v8 Control 4.4 requires that firewalls on servers restrict inbound traffic to only necessary services, and Control 4.5 extends this to end-user devices. This skill operationalizes those requirements into a repeatable audit process.

---

Process

Step 1: Discovery -- Locate Firewall Configurations

Use Glob and Grep to locate firewall configuration files, ACL definitions, and network policy documents.

Patterns to search:

# Platform-specific firewall configs
**/iptables*
**/nftables*
**/firewalld*
**/pf.conf
**/ufw*
**/*.acl
**/access-list*

# Cloud-native security groups and firewall rules
**/security-group*
**/network-policy*
**/firewall-rule*
**/*nsg*
**/*nacl*

# Infrastructure-as-Code definitions
**/*.tf          # Terraform (aws_security_group, google_compute_firewall, azurerm_network_security_group)
**/*.yaml        # Kubernetes NetworkPolicy, Calico policies
**/*.json        # CloudFormation, ARM templates