A firewall is not a set-and-forget appliance. Its rules evolve whenever a new office opens, a cloud service is introduced, a vendor needs access or an urgent troubleshooting change is made. Over time, those changes can leave behind permissions nobody needs, duplicate rules and exceptions that are difficult to explain.

For organisations operating across Papua New Guinea and the Pacific, the challenge can be greater. Distributed branches, remote sites, changing connectivity and multiple service providers often require practical exceptions. Those exceptions may be justified, but they still need ownership, documentation and regular review.

1. Nobody can explain why some rules exist

Every firewall rule should have a clear business purpose. Someone should be able to explain which system it supports, who requested it, what traffic it permits and whether it is still required. Rules with descriptions such as “temporary,” “testing” or a person’s name are warning signs when they have remained in place for months or years.

Unknown rules should not be deleted blindly because they may support a critical application. Instead, trace the source and destination, review recent usage, identify the system owner and confirm the requirement. If ownership cannot be established, place the rule into a controlled review process with monitoring and a rollback plan.

2. Rules are broader than the service requires

A common shortcut is allowing traffic from “any” source to “any” destination across a wide range of ports. It solves an immediate connectivity problem, but it also increases the number of paths an attacker could use after compromising a device.

Good rules follow least-privilege principles. Restrict the source, destination, application, service and direction as narrowly as the business process allows. Internet-facing access deserves particular attention. Administrative services should not be broadly exposed, and remote management should use secured access paths with multi-factor authentication wherever possible.

3. Disabled, duplicate and shadowed rules are accumulating

Large rule sets often contain disabled entries, duplicates and rules that will never be reached because an earlier rule already matches the traffic. This clutter does more than make the configuration untidy. It slows troubleshooting, makes audits harder and increases the chance that an engineer changes the wrong entry.

Review the policy for unused and overlapping rules, but keep change records before removing anything. A clean-up should be staged, documented and validated against business traffic. The goal is a smaller, clearer policy in which rule order and intent are easy to understand.

4. Temporary vendor and remote-access rules never expire

External vendors may need short-term access for support, upgrades or project work. Those connections should have a named sponsor, a defined destination, appropriate authentication and an expiry date. Access that remains open after the engagement ends creates avoidable exposure.

The same principle applies to old VPN groups, departed employees, former branch connections and test systems. Review access against current staff, suppliers, locations and contracts. If access must remain, confirm who monitors it and what evidence is retained.

5. There is no scheduled review or meaningful logging

If firewall changes are only examined during an incident or audit, the policy is already being managed reactively. Establish a review schedule based on the organisation’s risk and rate of change. Higher-risk or frequently changed environments may need monthly or quarterly checks, while stable environments should still have a documented periodic review.

Logging is equally important. A rule that permits sensitive access should generate enough information to support monitoring and investigation. Logs should be retained appropriately, time-synchronised and reviewed for unusual activity—not merely collected and forgotten.

A practical firewall review checklist

• Confirm every rule has a business purpose and accountable owner.
• Identify overly broad sources, destinations, services and applications.
• Review unused, duplicate, disabled and shadowed rules.
• Check vendor, VPN and temporary access for expiry dates.
• Validate administrative access and multi-factor authentication.
• Confirm important traffic is logged and actively monitored.
• Document each approved change and retain a rollback plan.

A careful review should reduce unnecessary access without disrupting the services your organisation depends on. If the environment is complex, begin with discovery and evidence rather than mass deletion.

Important: This article provides general guidance only. Firewall changes can interrupt critical services and should be planned, approved, tested and performed by appropriately qualified personnel.