Dave Mansfield and Jaswant Golan presented on how Hertfordshire County Council automated their firewall change management and risk assessment process. They developed a network model to visualize their infrastructure and automated the risk assessment of changes before implementation. This reduced the manual effort of their risk assessment process by 60% while providing complete visibility of security impacts and compliance with industry standards. They are now able to efficiently understand and reduce security risks of firewall changes.

1. www.hertsdirect.org
Finding and Understanding the Risk
Impact of Firewall Changes
Dave Mansfield, Head of IT Technology
Jaswant Golan, Technical Security Officer

2. www.hertsdirect.org
Your Speakers
Dave Mansfield – Head of Technology HCC
Head of Technology 3 years
Infrastructure Manager for 5 years
Network and Security Manager for 15 years (Public and Private)
Jaswant Golan – Technical Security Officer HCC
Technical Security Officer 8 years (HCC)
Security Compliance Manager 3 years (Private Sector)
Systems Architect 8 years (Financial Sector)

3. www.hertsdirect.org
About Hertfordshire County Council

4. Heading
Sub heading
Body text
Business Challenges
• Large and complex
infrastructure with many
change requests
• Many outsourced service
providers
• Limited management
visibility of firewall change
impacts
• Resource intensive risk
identification process
• Ensure compliance with
industry standards
Focus on critical risks

5. www.hertsdirect.org
Network model to visualize infrastructure
ThreatsConfig data and
routing tables VulnerabilitiesLayer 3
Devices Assets

6. www.hertsdirect.org
Policy Compliance
• Internal security
policy
• UK Public Service
Network (PSN)
• PCI and ISO 27001
• Trusted zones
trusting semi-trusted
zones
Compliance Assessment

7. www.hertsdirect.org
Automating Change Management Risk Assessment
Technical
Details
Change
Request
Risk
Assessment
Change
Implementation
Reconcile
and Verify
Automate the management
process
• Monitor changes
• Automate risk
assessment before
change is made
• Identify devices involved
• Deliver access path
information immediately
• Handle exceptions
• Reconcile changes

8. www.hertsdirect.org
Assess Risk Before Implementation
• Reduced manual
effort by 60%
• Police firewall
changes
• Focused on
outcome instead
of ACLs and rules
• ‘Think Security’

9. www.hertsdirect.org
Intelligent use of Independent Pen Tests
Vulnerability Hot Spots
Attack Vectors
Virtual pen test
Target concentrations of
vulnerabilities to meet SLAs
Target attack vectors against
critical assets
Attack Vectors
Target specific attack vectors
Vendor Security
Bulletins
Business Units
Technical
Groups
Vulnerability
Severity

10. www.hertsdirect.org
Results
• Understand downstream impact and risk of proposed
firewall changes in seconds
• 60% reduction in manual effort for firewall change
assessment process
• Complete visibility of security network infrastructure
• Regulatory evidential support
• Understand firewall rules and what they actually do
• Focused on effectively reducing risk
• Able to meet future needs and enable new business
services
• Even the firewall blokes are using the tool !

11. www.hertsdirect.org
thank you

12. www.hertsdirect.org