Situation
A growing Canadian organization has accumulated firewall rules across an internet edge, site-to-site links, and remote access. Requests arrive through email and chat. Several rules have no owner, expiry date, or business reason, and nobody is comfortable removing them without evidence.
Approach
- Review current rule sets, objects, administrative access, logging, and change records within the agreed scope.
- Classify rules by business owner, source, destination, service, exposure, last observed use, and review date where reliable data is available.
- Define an approval path with clear separation between requester, technical reviewer, approver, and implementer where staffing permits.
- Pilot a firewall change record that requires a test plan, maintenance window, monitoring plan, and rollback trigger.
- Create a prioritized remediation register rather than deleting uncertain rules on sight.
Validation
- HAI Consulting would not remove or alter production rules without approved scope, an authorized change, a tested rollback path, and an agreed maintenance window.
- Any conclusions would be limited to the approved scope, the evidence available, and the conditions at the time of review.
- The organization would review factual accuracy, own production decisions, and approve any risk acceptance or implementation work.