Invictus TechnologyInvictus Technology All articles
Firewalls 28 July 2026 5 min read

Firewall rule hygiene: auditing the rule base nobody owns

Every firewall we inherit has rules from engineers who left years ago. Here is the review process we use to shrink a rule base safely.

By Invictus Technology

The rule base always grows

Firewall policies only ever get longer. A project needs access, a rule goes in at the top, and it stays there long after the project ends. We regularly take over firewalls with several hundred rules where fewer than half still match traffic.

Every stale rule is either an unnecessary hole or an obstacle to troubleshooting. Both cost you.

A review that will not break production

  • Pull hit counts for every rule over at least 90 days.
  • Flag zero-hit rules, but do not delete them yet — annual processes exist.
  • Disable rather than delete, and leave the rule disabled for a full cycle.
  • Replace any-any service definitions with the specific ports actually observed.
  • Collapse duplicate rules that differ only by source object.
  • Record a business owner and a review date against every surviving rule.

Watch the order, not just the content

Rules are evaluated in order. A broad permit sitting above a specific deny quietly nullifies the deny. After any cleanup, re-run a policy analysis to confirm nothing shadows anything below it.

The same applies to logging. Rules that permit large volumes of internal traffic often have logging switched off for performance, which is exactly where you lose visibility during an investigation. Log the inter-zone rules at minimum.

Make it routine

We review managed firewall policies quarterly and provide the client with a change record: rules added, rules removed, exceptions still outstanding and who owns them. It takes an afternoon per quarter and prevents the five-year cleanup project.

More articles

Wireless

Secure enterprise Wi-Fi: beyond a shared passphrase

One password for the whole organisation is not a security model. What 802.1X, role-based SSIDs and a proper RF survey actually change.

SOC & SIEM

SOC and SIEM: what a mid-sized business actually needs

You do not need a hundred correlation rules on day one. You need log coverage, a handful of high-fidelity detections and someone awake at 2am.

Network Security

Network segmentation: the control that limits every breach

Segmentation is the difference between one infected laptop and a plant-wide outage. Here is how we design zones for real industrial and corporate networks.