Gerenciamento de firewalls em redes híbridas

Abstract

Managing firewalls is a challenging process. The incorrect configuration of this type of equipment can generate problems ranging from security breaches that compromise the information transmitted to the unavailability of critical services. The process is especially challenging for hybrid networks, which combine conventional and emerging technologies such as SDN. The firewall administrator of a hybrid network needs to know a potentially extensive combination of vocabulary, syntax, semantics and processes to configure the firewalls according to their intention. To facilitate the work of hybrid network administrators, we propose a software architecture, called FWunify, and a language for representing security intentions, called FWlang. The software architecture aims to guide the development of solutions for managing firewalls in hybrid networks through layers and modules that facilitate the maintainability and extensibility of the solution. For example, a command translation module for a given firewall can be added (or removed) from the solution with minimal impact only on adjacent layers. The FWlang language aims to simplify and reduce the vocabulary needed to manage a hybrid park of firewalls through intentions, which allow representing security configurations at a higher and more friendly level of abstraction than the level of a conventional policy. To verify the technical feasibility of the solution, we implemented an instance of the FWunify software architecture, including FWlang. A comprehensive functional assessment of FWunify demonstrates its accuracy for translating (for low-level commands used in firewalls) and its ability to manage policies across real firewalls. Through an assessment based on real datasets, we demonstrate that FWlang can provide a reduction of up to 72% in the number of terms used to describe a given type of policy. Finally, we evaluate subjective aspects, such as intuitiveness and complexity, of FWlang through a questionnaire answered by system administrators.