[Contest Entry]

Title:

Smart & Automated Firewall Policies based on Network Monitoring Health Checks

Introduction:

As a network security engineer and my knowledge about the capabilities of WUG and its API, as well as other security solutions, specifically Check Point Firewalls that also has a new API, I bring an idea to implement a system that would orchestrates between these two solutions to make smart and automated policy decisions/policies.

Benefit:

When devices or servers are brought in for maintenance, special security policies are required. Depending on the case and client, some will require to assign or remove network permissions. These are not always scheduled correctly and result in calls to the help desk for special policies during the maintenance window. Furthermore, after the maintenance window, many forget to revert these policies again and servers remains exposed to ports and connections that are not necessary.

Case of use:

Knowing WhatsupGold and Check Point Software Technologies, I can see this use case where the Check Point Firewalls, starting with their new version R81, have an API that allows defining dynamic objects in their rules that feed from API reads in JSON format from others systems. These WhatsupGold API capabilities added to the Check Point API capabilities can enable a project or system in the following way:

Creating a system that works as an intermediary in the communication and orchestration of the WhatsupGold APIs and the Check Point API, communicating in JSON format bidirectionally with both solutions, so it could:

Scope:

1. Assign special permissions when a server is under maintenance:

1.1. "Allow servers to access update download centers only while in maintenance mode." Detailed: You can program the following: When you want to do maintenance on a server, we enter WUG and place the equipment in "Maintenance", this status would be monitored by the intermediary system through the new API, the system notices the change and It also notifies the Check Point firewall via API, which enables access rules to download centers for the IP of this server, with its web filtering and application control functions. Once the maintenance is finished, we will only have to remove the "Maintenance" status again and the Firewall will be able to disable the temporary rules created.

1.2. "Deny external or VPN access when a server is in maintenance mode" or "Allow SSH or RDP only when in Maintenance Mode"

Detailed: similarly to the previous one, when a server is placed in Maintenance within WUG, the system could notify the Firewall to allow/deny the access of other systems/users to this server, to prevent for example unwanted replications or access of a provider or third party via VPN to this server for the duration maintenance or allow terminal connections (SSH/RDP) only when it is un mantenance. These changes in the Firewall could be dynamic because it would be monitoring the status of the device within WUG.

2. Create dynamic access rules in the firewall for new network devices created in WhatsupGold

Detailed: it could monitor a group of devices within the WUG for example dynamic groups or groups resulting from discovery scans to dynamically create allowed / denied access security policies according to the use case within the Firewall for these newly added/discovered servers by WUG. This will allow you to have a base/basic security policy when the server / device appears on the network. Avoiding unexpected access when creating a new device on the network, without having to create permissions to global network groups.

3. Monitor new security devices

Detailed: the system could also monitor the creation of new security devices within the management of the firewalls, such as a new Firewalls created and thus use the API to add it as a new security device monitor and add some performance monitors to it.

And probably many other use cases can be developed around this communication that could be extended to other manufacturers of security equipment not limited to Check Point. Eg. A NAC (Network Access Control) solution that detects a new server on the network could add it to WUG, etc.

Thanks,

att. Randol Chen