Most firewall breaches we investigate at small and mid-sized companies are not clever zero-days. They are rules someone added three years ago "just for this weekend" and never removed. If you run more than one site (a head office plus a warehouse, or branches across Dubai, Abu Dhabi and Muscat), the problem multiplies.
This is the checklist our engineers use when we take over a firewall estate. It is vendor-neutral: it applies whether you run Sophos, Fortinet, Palo Alto or Check Point.
1. Export and baseline everything first
Before touching a single rule, export the full config from every device and commit it to version control (a private Git repo is fine). You want a diff for every change you make from now on.
# example: keep nightly config exports under git
cd /opt/fw-configs
git add . && git commit -m "nightly export $(date +%F)"
2. Find rules with zero hits
Every major vendor tracks hit counts per rule. Pull rules with zero hits in the last 90 days. In a typical SME estate we find 20-40% of rules are dead weight. Disable them first (do not delete), wait two weeks, then remove.
3. Kill "any/any" and wide-open services
Search for rules where source, destination or service is any. Each one needs a named owner and a written reason, or it goes. Pay special attention to inbound RDP, SMB and management interfaces exposed to WAN.
4. Add expiry dates to temporary rules
Most modern firewalls support scheduled or time-limited rules. Any rule created for a project, vendor visit or migration should carry an expiry. If your platform does not support it, put the expiry date in the rule comment and review it monthly.
5. Standardise object naming across sites
SRV-ERP-01, NET-DXB-LAN, GRP-FINANCE-USERS. When three sites name the same server three different ways, rule review becomes guesswork. Agree a naming convention and enforce it.
6. Keep firmware current, and test it
Unpatched firewall firmware is one of the most exploited entry points of the last two years. Schedule updates monthly, stage them on the least critical site first, and keep a rollback image.
7. Centralise management once you pass three devices
Logging into each box separately does not scale. Use the vendor's central console, or a vendor-neutral tool, so policy, firmware status and logs are visible in one place. (Full disclosure: our team built Raabyt UFM for exactly this problem across mixed-vendor estates.)
8. Forward logs somewhere you will actually look
Logs that stay on the device are useless during an incident. Ship them to a SIEM or at least a central syslog with 90+ days retention, and set alerts for config changes and admin logins.
A quick quarterly routine
| Task | Frequency |
|---|---|
| Zero-hit rule review | Quarterly |
| Temporary rule expiry check | Monthly |
| Firmware update (staged) | Monthly |
| Admin account review | Quarterly |
| Config backup restore test | Twice a year |
I work with Artiflex Information Technology, an IT solutions company in Dubai serving the UAE, Oman, Saudi Arabia and India. If you are an IT manager looking for an IT solutions provider in Dubai to help with firewall, cybersecurity or managed IT, you can find us at artiflexit.com. Happy to answer questions in the comments.
Top comments (0)