This document summarizes Skybox Security's firewall change management solution. The solution provides (1) technical translation of change requests, (2) risk assessment of proposed changes, (3) implementation of approved changes grouped by firewall, and (4) verification that changes match approved tickets. This integrated workflow is designed to reduce workload, risks, and errors compared to manual change management processes.

1. Firewall Change Management
Sean Keef
Director of Sales Engineering

2. Solution Overview
Network Security Management
Vulnerability & Threat Management
Change Management
Remediation
Analysis / Prioritization
Policy Compliance
Optimization & Cleanup
© 2013 Skybox Security Inc.
Discovery
2

3. Change Management Workflow
Request
Technical
Translation
Risk
Assessment
Implementation
Ticketing System
Or
Manual Process Manual Process
eMail
© 2013 Skybox Security Inc.
3
Not Done
Verification

4. Change Management Integration
Request
3rd Party Ticketing System
Technical
Risk
or
Implementation
Details
Assessment
Skybox Change Manager
Skybox Analytics Engine
© 2013 Skybox Security Inc.
4
Verification

5. Change Management Integration
Technical
Details
Request
 Translate
 Path
identification
 Rule analysis
Risk
Assessment
•
•
•
•
•
Reduce workload
Reduce time to process
Reduce # of firewall changes
Reduce overlapping rules
Excellent ROI
Skybox Analytics Engine
© 2013 Skybox Security Inc.
Implementation
5
Verification

6. Technical Details
© 2013 Skybox Security Inc.
6

7. Technical Details
© 2013 Skybox Security Inc.
7

8. Risk Assessment
Skybox and/or 3rd Party Ticketing System
Request
Technical
Details
Risk
Assessment
 Identify policy
violations &
 Vulnerability
exposures
 Accept/Reject
Skybox Analytics Engine
© 2013 Skybox Security Inc.
8
Implementation
Verification
• Reduce human error
• Reduce role back
• Reduce
misconfigurations
• Create risk acceptance
audit trail

9. Risk Assessment
© 2013 Skybox Security Inc.
9

10. Change Management Workflow – 3rd Party
Skybox and/or 3rd Party Ticketing System
Request
Technical
Details
Risk
Assessment
• Administrators see only the changes
they are responsible for
• Displayed by firewall – not by ticket
• Tickets are promoted when all
changed have been implemented
• Auto-provisioning in the works
Implementation
 Changes
are queued
by firewall
Skybox Analytics Engine
© 2013 Skybox Security Inc.
10
Verification

11. Verification
Skybox and/or 3rd Party Ticketing System
Request
Technical
Details
•
Risk
Assessment
3rd
Implementation
party validation that a change
ticket has been implemented
• Protection against “fat fingering”
• Changes without tickets can be
identified
Skybox Analytics Engine
© 2013 Skybox Security Inc.
11
Verification
 Reconcile
against
observed
changes
 Verify
Access

12. Summary
 Path Analysis – Demonstrable ROI
 Risk Analysis – Automated, accurate, complete
 Implementation – Changes grouped by firewall
 Reconciliation – 3rd party validation of ticket completion
© 2013 Skybox Security Inc.
12