Firewall rules
Unused firewall rules are accumulated risk.
What the published 2016 guidance says
Unused firewall rules are accumulated risk. The construct counts border firewall rules that were used zero times in the sampling period. The target is zero. Evidence is the usage counter on each rule. It is collected twice a year or yearly. The network manager or security manager owns it and is the client, and a network or security analyst collects. The data is the firewall console and the firewall review report. The result is a count or list of unused rules marked for review and possible deletion.
What it means in practice
Unused firewall rules are accumulated risk. Count rules with zero hits in the sampling period, then review rather than delete blindly. The measure is only as good as the logging and the review that follows it.
Status of this record. For B.26, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the firewall rule usage counters and the review report. Count the rules with zero hits in the period. Review each before deletion. Record the decision for each rule.
Evidence an assessor asks for
- Network securityFirewall rule usage counters over the period
- Configuration managementReview report listing unused rules and their disposition
The question an assessor will ask
An assessor will ask for firewall rule usage counters over the period. The test for B.26 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Hit counters reset between reviews, so usage cannot be judged
- Unused rules listed but never removed
Before the next review
Before the next review, test this against one live record: hit counters reset between reviews, so usage cannot be judged.
What to check when the revision publishes
When DIS 27004 is published, compare the B.26 Firewall rules record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.