Towards quantification of firewall policy complexity

Abstract

Developing metrics for quantifying the security and usability aspects of a system has been of constant interest to the cybersecurity research community. Such metrics have the potential to provide valuable insight on security and usability of a system and to aid in the design, development, testing, and maintenance of the system. Working towards the overarching goal of such metric development, in this work we lay down the groundwork for developing metrics for quantifying the complexity of firewall policies. We are particularly interested in capturing the human perceived complexity of firewall policies. To this end, we propose a potential workflow that researchers can follow to develop empirically-validated, objective metrics for measuring the complexity of firewall policies. We also propose three hypotheses that capture salient properties of a firewall policy which constitute the complexity of a policy for a human user. We identify two categories of human-perceived policy complexity (i.e., syntactic complexity and semantic complexity), and for each of them propose potential complexity metrics for firewall policies that exploit two of the hypotheses we suggest. The current work can be viewed as a stepping stone for future research on development of such policy complexity metrics.

Measuring the Usability of Firewall Rule Sets

“…Simply counting the number of elements in the rule set may mask the cognitive aspects related to the structure of the rule set along with the ordering and organization of rules in the set. This aspect is hinted at in the literature in the work by [18] on human perceived complexity and can be related to the dependency metric proposed by Acharya et al [15] if interpreted from a cognitive perspective. We suspect that the cognitive aspects may have a significant role in the evaluation of the elements of a rule set.…”

“…Chen et al [18] proposed a set of metrics to quantify the complexity of a firewall rule set to quantify the human perceived complexity. They classified complexity into two groups: inherent and representational.…”