Systematic Literature Review on Usability of Firewall Configuration

Voronkov, Artem; Iwaya, Leonardo Horn; Martucci, Leonardo A.; Lindskog, Stefan

doi:10.1145/3130876

Cited by 25 publications

(14 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The techniques presented in this paper are fully automatic and do not require any interaction with the network administrator. However, as a future work, we propose to explore the potential of putting the network administrator in the loop and providing visualization tools 32 to assist the administrator in managing the order of the rules of the firewall to increase its performance.…”

Section: Resultsmentioning

confidence: 99%

On optimizing firewall performance in dynamic networks by invoking a novel swapping window–based paradigm

Mohan

Yazidi

Feng

et al. 2018

Int J Communication

View full text Add to dashboard Cite

Designing and implementing efficient firewall strategies in the age of the internet of things is far from trivial. This is because, as time proceeds, an increasing number of devices will be connected, accessed, and controlled on the internet.Additionally, an ever-increasingly amount of sensitive information will be stored on various networks. A good and efficient firewall strategy will attempt to secure this information and to also manage the large amount of inevitable network traffic that these devices create. The goal of this paper is to propose a framework for designing optimized firewalls for the internet of things. This paper deals with 2 fundamental challenges/problems encountered in such firewalls.The first problem is associated with the so-called rule matching time problem.Here, we propose a simple condition for performing the swapping of the firewall's rules; using which, we can guarantee the firewall's consistency and integrity and also ensure a greedy reduction in the matching time. Unlike the state of the art, our swapping condition considers rules that are not necessarily consecutive, using a novel concept referred to as a "swapping window." The second contribution of our paper is a novel "batch"-based traffic estimator that provides network statistics to the firewall placement optimizer. The traffic estimator is a subtle but modified batch-based embodiment of the Stochastic Learning Weak Estimator. Further, by performing a rigorous suite of experiments, we demonstrate that both algorithms are capable of optimizing the constraints imposed for obtaining an efficient firewall. KEYWORDSbatch update, firewall optimization, learning automata, matching time, nonstationary environments, weak estimators John Oommen is a Chancellor's Professor, Fellow of the IEEE, and Fellow of the IAPR. He is also an Adjunct Professor at Agder University College in Grimstad, Norway. Int J Commun Syst. 2018;31:e3773. wileyonlinelibrary.com/journal/dac Wild card 192.0.* Address range 192.0.0.0-192.0.255.255 Range 192.0.2.2-192.0.2.150 The given range of addresses Single 192.0.2.2 A single given IP address

show abstract

Section: Resultsmentioning

confidence: 99%

On optimizing firewall performance in dynamic networks by invoking a novel swapping window–based paradigm

Mohan

Yazidi

Feng

et al. 2018

Int J Communication

View full text Add to dashboard Cite

show abstract

“…It is worth noting that rule conflict problem can occur; however, this problem is well investigated in the literature. Methods such as the one in [186] can be used to detect potential rule conflict before committing a new rule. A smart home scenario will be used in this chapter as a typical smart space to present the framework and its components.…”

Section: Introductionmentioning

confidence: 99%

Fine-grained Access Control for Internet of Things Smart Spaces Driven by User Inputs

Al-Shaboti¹

2021

Preprint

View full text Add to dashboard Cite

The increasing use of Internet of Things (IoT) devices raises security and privacy concerns. In smart spaces, multiple IoT devices are simultaneously used to fulfil user activity functions. However, these devices exhibit several security vulnerabilities that can compromise smart space security and privacy. The ability of fine-grained control network access in IoT devices and application messages can significantly reduce the risk resulting from the exploitation of IoT vulnerabilities due to unauthorised access, thereby improving smart space security. A well-recognised approach in the literature for IoT access control is to use pre-defined access policies to allow the necessary connections for a device to function correctly. However, these policies allow access to all device functions (i.e. coarse-grained access) including those functions that are not used by any user activity. The overall goal of this thesis is to develop an access control framework and techniques to achieve fine-grained access policies by using user inputs. The user inputs will be utilised to select devices to fulfil user activities aiming to build an access policy from the minimum access required for each device function. In this thesis, the use of user inputs to meet user security and privacy requirements in single- and multi-user smart spaces is studied. The main contributions are as follows: first, an access control framework that enables users to tailor IoT device policies to meet their security and privacy requirements is proposed. Validation results of the framework show the effectiveness of integrating user access rules into the existing security countermeasures (i.e. pre-defined policies and intrusion detection systems – IDS) to enforce user security and privacy. Second, the problem of selecting preferable devices to fulfil user activity functions is formulated as an optimisation problem. The optimisation problem is then solved by local and global optimisation searching algorithms that are guided by a developed user preference quantified model. The results show that global optimisation search algorithms such as Genetic Algorithm (GA) find the solution more effectively and efficiently than local search algorithms such as simulated annealing and hill-climbing. Third, sharing access control for multi-user smart spaces is proposed. Traditional access control that considers a single user is not suitable for multi-user smart spaces, where users share their IoT devices. The sharing between multiple users poses challenges different than in single-user access control. For example, users may abuse using shared devices and use vulnerable ones. This thesis addresses these two challenges through two contributions. First, it proposes a novel sharing policy language that enables users to precisely define their sharing policy. Second, this thesis formulates the sharing policies as constraints in the context of an optimisation problem with the objective function that maximises the use of secure devices. Results show that the IoT sharing issue can naturally be translated into an integer linear programming (ILP) problem and effectively solved using off-the-shelf ILP solvers. Fourth, this thesis explores the feasibility and practicality of the fine-grained access policy enforcement through a smart home case study. A case study is built using a hub-based architecture that uses Web of Things (WoT) technology. WoT provides a device semantic description that includes device functions with the corresponding Uniform Resource Identifier (URI) which is used to build access control policies. The case study results show that policy enforcement can be effectively achieved by directing network traffic through a device proxy for each IoT device to enforce application access control without introducing statistically significant overhead on the user activity running time. In summary, this thesis studies the use of user inputs to derive fine-grained access control in smart spaces. For a single-user access control system, this thesis considers using manual rules and user preferences in small and dense smart spaces, respectively. For a multi-user access control system, this thesis proposes a secure sharing system supported by a sharing policy language to share and use IoT devices securely. For each scenario analysed, user input is utilised to derive fine-grained access policies. Enforcement of these policies has been explored by implementing a smart space case study using WoT technology. The overall results show that user preferences and sharing policies can be used to derive fine-grained access policies that are transparent to users and meet their security and privacy requirements.

show abstract

“…Although most of them are purely theoretical, they stress the relevance of the problem of quantifying the usability of rule sets. The literature review on the usability of firewall configuration by Voronkov et al [8] investigates solutions to help professional and non-professional users in creating and managing firewall configuration files, and analyzes such solutions in respect to usability. The authors observe that there is a general lack of usability evaluation or user studies for validating the claims in the 14 articles included in the systematic literature review.…”

Section: Introductionmentioning

confidence: 99%

Measuring the Usability of Firewall Rule Sets

2020

Self Cite

View full text Add to dashboard Cite

Firewalls are computer systems that assess the network traffic using an ideally coherent and manageable set of rules. This study aims to provide means to measure the usability of firewall rule sets in terms of how easily IT professionals can understand and manage them. First, we conducted semi-structured interviews with system administrators wherein we obtained the usability challenges related to the management of firewall rule sets. This was followed by the analysis of related work. The interview results were combined with the findings from the related work. Accordingly, we acquired four usability attributes related to the manageability of firewalls; these were formally defined. We tested and measured the cognitive aspects related to the structure and ordering of the rules through a user study. A third user study with system administrators validated our metrics. It exhibited a very strong correlation between the metrics and how the administrators characterized usability.

show abstract

Systematic Literature Review on Usability of Firewall Configuration

Cited by 25 publications

References 49 publications

On optimizing firewall performance in dynamic networks by invoking a novel swapping window–based paradigm

On optimizing firewall performance in dynamic networks by invoking a novel swapping window–based paradigm

Fine-grained Access Control for Internet of Things Smart Spaces Driven by User Inputs

Measuring the Usability of Firewall Rule Sets

Contact Info

Product

Resources

About