Field Note: What a Firewall Rule Review Actually Finds

A firewall rule review is usually sold as clean-up. Done well, it is a test of whether the network policy you think you enforce is the policy the devices enforce. This field note sets out the categories of finding a review should look for, how to rate them, and what to do next. The categories are a Cybrilliant practitioner pattern. They are not a measured frequency, and we do not claim figures from named engagements.

What the standard guidance says a ruleset should be

NIST SP 800-41 Revision 1 (September 2009) is older guidance that still frames the test. Its core points are these.

• Deny by default. Traffic not expressly permitted by the firewall policy should be blocked. NIST calls this deny by default and says it is more secure than permitting everything not explicitly forbidden.

• Specific rules. Rulesets should be as specific as possible about the traffic they control.

• Order matters. Some firewalls check rules in sequence until a match is found, so rule position affects both behavior and performance.

• Formal change control. Rulesets and policies should be managed through a formal change management process, with periodic ruleset reviews or tests to confirm continued compliance with policy.

• Policy first. The firewall policy should come from a risk analysis of the traffic the organization needs, and be kept up to date as applications and threats change.

Eight categories of finding

Why cross-zone and supplier paths rank high

The Equifax record in the House Oversight report notes that the affected application required access to only three databases, yet was not segmented from unrelated ones, so attackers using its credentials reached 48. The Target staff report suggests Target did not properly isolate its most sensitive network assets from a vendor access path, though the report relied on media accounts. Our reading: a rule review that looks only at individual rules will miss the structural question of which zones can talk to which.

Platform currency is not a side issue. CISA Emergency Directive 25-03 (25 September 2025) reported exploitation of two zero-day vulnerabilities in Cisco ASA devices, CVE-2025-20333 and CVE-2025-20362, with manipulation of read-only memory so the compromise persisted through reboot and upgrade. It ordered US federal agencies to identify devices, apply the first updates by 26 September 2025 and apply later updates within 48 hours of release, and a later note said some agencies had marked devices patched while running a still-vulnerable version. It binds only federal agencies. For everyone else it is a case for verifying the version, not trusting the record.

How to run the review

1. Collect the full configuration and the policy. Compare rules against the written firewall policy, if one exists. If none exists, writing one is finding number one.

2. Analyze the ruleset with hit counts over a long enough window to cover monthly and quarterly jobs. A rule with no hits in the window is a candidate, not a proof.

3. Interview the owners. For every candidate removal, ask the business whether it is still needed. Record the answer.

4. Test the zones. Pick representative paths between zones and check whether the rules you expect to block actually do.

5. Rate, agree and sequence. Fix management-plane exposure and over-broad permits first. Stage removals with rollback.

6. Close the loop. Put rule creation under change control with an owner and an expiry date, and schedule the next review.

Decision

Decision: do not start with rule clean-up. Start with the zone map and the policy. Tidy rules inside a wrong zone design are still wrong.

What this evidence does not show

NIST SP 800-41 Revision 1 dates from 2009 and predates cloud security groups and next-generation firewalls, though the principles carry over. We cite no benchmark for how many unused rules a typical firewall holds. The eight categories and ratings are Cybrilliant analysis.

A short test

Pick the rule that lets the most sensitive zone talk to anything outside it. Find its owner, its ticket and its last review date. If you cannot, start there.

Sources

1. NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy, September 2009. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf

2. US House Committee on Oversight and Government Reform, Majority Staff Report, The Equifax Data Breach, December 2018. Accessed 9 October 2026. oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf

3. US Senate Commerce Committee, Majority Staff Report, A Kill Chain Analysis of the 2013 Target Data Breach, 26 March 2014. Accessed 9 October 2026. commerce.senate.gov/wp-content/uploads/media/doc/2014%200325%20Target%20Kill%20Chain%20Analysis.pdf

4. CISA Emergency Directive ED 25-03, Identify and Mitigate Potential Compromise of Cisco Devices, 25 September 2025. Accessed 9 October 2026. cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices