System and method for detecting forbidden network accesses based on zone connectivity mapping

A method for automating identifications of forbidden network connections, comprising:

• creating a network connectivity matrix between neighboring network zones adjacent to a firewall device, wherein:
• the network connectivity matrix comprises a set of allowability indications indicating whether establishing network connections between different neighboring network zones is allowed;
• neighboring devices belong to corresponding neighboring network zones;
• each of the neighboring devices is identified by a name set by a naming convention that is associated with a particular neighboring network zone, such that:
• a first device, connected to a first interface of the firewall device, is identified by a first name indicating that the first device belongs to a first network zone, wherein:
• the first name is determined based at least on a first naming convention used for naming devices that belong to the first network zone;
• and
• the first naming convention indicates that a first keyword and at least one additional alphanumeric character is included in the first name;
• and
• a second device, connected to a second interface of the firewall device, is identified by a second name indicating that the second device belongs to a second network zone, wherein:
• the second name is determined based at least on a second naming convention used for naming devices that belong to the second network zone;
• the second naming convention indicates that a second keyword and at least one additional alphanumeric character is included in the second name;
• and
• the first keyword is different from the second keyword;
• creatine an interface-to-zone map that indicates mappings between a given interface of the firewall device and a respective network zone from within which a device is connected to the given interface based at least in part upon the naming convention used for naming each of the neighboring devices, such that the given interface connected to a device having a name with a particular keyword associated with the respective network zone is mapped to the respective network zone;
• determining whether there is any network connection between different neighboring devices that violates a corresponding allowability indication indicated in the network connectivity matrix based at least in part upon cross-referencing the interface-to-zone map with the network connectivity matrix, wherein determining whether there is any network connection between different neighboring devices that violates the corresponding allowability indication indicated in the network connectivity matrix based at least in part upon cross-referencing the interface-to-zone map with the network connectivity matrix comprises:
• determining that the network connectivity matrix indicates a first network connection from the first device to the second device;
• determining that the interface-to-zone map indicates that the first interface of the firewall device is mapped to the first network zone;
• determining that the interface-to-zone map indicates that the second interface of the firewall device is mapped to the second network zone;
• identifying a particular allowability indication associated with network connections from the first network zone to the second network zone as indicated in the network connectivity matrix;
• and
• determining whether the particular allowability indication indicates the network connections from the first network zone to the second network zone are allowed;
• and
• in response to determining at least one network connection between different neighboring devices that violates the corresponding allowability indication, determining that the at least one network connection is a forbidden network connection.

A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to:

• create a network connectivity matrix between neighboring network zones adjacent to a firewall device, wherein:
• the network connectivity matrix comprises a set of allowability indications indicating whether establishing network connections between different neighboring network zones is allowed;
• neighboring devices belong to corresponding neighboring network zones;
• each of the neighboring devices is identified by a name set by a naming convention that is associated with a particular neighboring network zone, such that:
• a first device, connected to a first interface of the firewall device, is identified by a first name indicating that the first device belongs to a first network zone, wherein:
• the first name is determined based at least on a first naming convention used for naming devices that belong to the first network zone;
• and
• the first naming convention indicates that a first keyword and at least one additional alphanumeric character is included in the first name;
• and
• a second device, connected to a second interface of the firewall device, is identified by a second name indicating that the second device belongs to a second network zone, wherein:
• the second name is determined based at least on a second naming convention used for naming devices that belong to the second network zone;
• the second naming convention indicates that a second keyword and at least one additional alphanumeric character is included in the second name;
• and
• the first keyword is different from the second keyword;
• create an interface-to-zone map that indicates mappings between a given interface of the firewall device and a respective network zone from within which a device is connected to the given interface based at least in part upon the naming convention used for naming each of the neighboring devices, such that the given interface connected to a device having a name with a particular keyword associated with the respective network zone is mapped to the respective network zone;
• determine whether there is any network connection between different neighboring devices that violates a corresponding allowability indication indicated in the network connectivity matrix based at least in part upon cross-referencing the interface-to-zone map with the network connectivity matrix, wherein determining whether there is any network connection between different neighboring devices that violates the corresponding allowability indication indicated in the network connectivity matrix based at least in part upon cross-referencing the interface-to-zone map with the network connectivity matrix comprises:
• determining that the network connectivity matrix indicates a first network connection from the first device to the second device;
• determining that the interface-to-zone map indicates that the first interface of the firewall device is mapped to the first network zone;
• determining that the interface-to-zone map indicates that the second interface of the firewall device is mapped to the second network zone;
• identifying a particular allowability indication associated with network connections from the first network zone to the second network zone as indicated in the network connectivity matrix;
• and
• determining whether the particular allowability indication indicates the network connections from the first network zone to the second network zone are allowed;
• and
• in response to determining at least one network connection between different neighboring devices that violates the corresponding allowability indication, determine that the at least one network connection is a forbidden network connection.