We've audited over 400 firewall configurations across South African organisations. The average enterprise firewall has 847 rules. Of those, roughly 23% are redundant, 11% are shadowed, and at least 4% contain overly permissive "any-any" statements that effectively negate the firewall's purpose.
By Neil Beulecke, Managing Director — Layer7 Networking
The Rule Sprawl Problem
Firewall rules accumulate like sedimentary rock. Each project, each vendor deployment, each emergency change adds rules. Almost nobody removes them. After five years, a typical enterprise firewall carries hundreds of rules that no one fully understands, and no single person can explain the business justification for each one.
This isn't a theoretical concern. In our Firewall Assurance and Compliance (FAC) assessments, we routinely find:
- Shadowed rules — rules that never match traffic because a broader rule above them catches everything first. These indicate that the rule author didn't understand the existing policy. They're noise, but they're also evidence of poor change management.
- Redundant rules — multiple rules that achieve the same effect. They increase processing overhead and make auditing harder.
- Overly permissive rules — the classic "any source, any destination, any service, permit" rule added during a troubleshooting session at 2 AM and never removed. We found one organisation with 17 of these across their production firewalls.
- Rules referencing decommissioned hosts — servers that were retired years ago but still have firewall rules permitting traffic to their former IP addresses, which may now be assigned to different systems.
Why This Matters
A firewall with 800+ unreviewed rules isn't a security control — it's a compliance checkbox. Attackers don't need to bypass your firewall if your rules already permit the traffic they need. Lateral movement, command-and-control callbacks, data exfiltration — if your rules are permissive enough, the firewall logs the traffic and waves it through.
We've seen breaches where the forensic investigation revealed that every single step of the kill chain traversed the firewall legitimately — because the rules allowed it.
The Review Cadence Problem
Most organisations we work with have no formal firewall rule review process. Those that do typically review annually — which is insufficient given the pace of infrastructure change. Best practice is quarterly review of all rules, with monthly review of any rule flagged as high-risk (broad permissions, internet-facing, or critical asset access).
The challenge is that manual rule review doesn't scale. Reading 800 rules line by line is tedious, error-prone, and requires deep knowledge of both the network topology and the business context for each rule. This is why automated policy analysis tools exist — and why they should be part of every organisation's security toolkit.
Layer7's FAC Approach
Our Firewall Assurance and Compliance service takes a structured approach:
- Baseline audit. We ingest the complete rule set and run automated analysis to identify shadowed, redundant, overly permissive, and orphaned rules. This typically reduces the rule set by 20-30% in the first pass.
- Business context mapping. We work with the client's network and application teams to map remaining rules to business justifications. Any rule that can't be justified gets flagged for removal.
- Risk-based prioritisation. Not all rule violations are equal. An any-any rule on an internal management VLAN is lower risk than one on the internet-facing perimeter. We score and prioritise findings accordingly.
- Continuous governance. We establish a change management process for firewall rules — no rule is added without a documented business justification, an expiry date, and an owner. Rules are reviewed on a defined cadence.
- Reporting and compliance. Monthly reports show rule hygiene metrics, change trends, and compliance posture. This gives CISOs the data they need for board reporting and audit readiness.
Quick Self-Assessment
Answer these five questions about your firewall estate:
- When was the last time every rule was reviewed and justified?
- How many rules contain "any" in the source, destination, or service field?
- Do you have a documented process for rule retirement?
- Can you identify which rules are associated with decommissioned systems?
- Does every rule have a named owner and a business justification?
If you answered "no" or "I don't know" to three or more, your firewall rules are likely your biggest unmanaged risk. The good news: this is entirely fixable, and the ROI is measurable.
Layer7 Networking's Firewall Assurance and Compliance service has been helping South African organisations regain control of their firewall policies since 2003. Contact us for a complimentary initial assessment.