Method and apparatus for graphical presentation of firewall security policy

A system for reporting a data flow in a firewall, said system comprising:

• means for displaying a graphical representation of said firewall and a network coupled to said firewall;
• means for displaying a number of an inbound port of said network;
• and
• means for displaying an arrow adjacent to said port number pointing toward said network indicating that a communication is permitted to said port.

A computer program product for reporting a data flow in a firewall, said computer program product comprising:

• a computer readable medium;
• first program instructions to display a graphical representation of said firewall and a network coupled to said firewall;
• second program instructions to display a number of an inbound port of said network;
• and
• third program instructions to display an arrow adjacent to said port number pointing toward said network indicating that a communication is permitted to said port;
• and wherein
• said first, second and third program instructions are recorded on said medium.

A method for reporting data flow vulnerabilities in a firewall, said method comprising:

• generating and displaying a table including definitions of a plurality of rules, each of said definitions including an entry for a source IP address of a permitted but vulnerable data flow, an entry for a destination IP address of the permitted but vulnerable data flow, and an entry for a protocol or destination port of said permitted but vulnerable data flow;
• and wherein the generating and displaying includes:
• color coding said source IP address entry in said table to indicate a security level of a source network containing said source IP address;
• and
• color coding said destination IP address entry in said displayed table to indicate a security level of a destination network containing said destination IP address.

A computer program product for reporting data flow vulnerabilities in a firewall, said computer program product comprising:

• a computer readable medium;
• first program instructions to generate and display a table including definitions of a plurality of rules, each of said definitions including an entry for a source IP address of a permitted but vulnerable data flow, an entry for a destination IP address of the permitted but vulnerable data flow, and an entry for a protocol or destination port of said permitted but vulnerable data flow;
• and wherein said first program instructions include:
• second program instructions to color code said source IP address entry in said table to indicate a security level of a source network containing said source IP address;
• and
• third program instructions to color code said destination IP address entry in said displayed table to indicate a security level of a destination network containing said destination IP address;
• and wherein
• said first, second and third program instructions are recorded on said medium.

A method for reporting data flow misconfigurations in a firewall, said method comprising:

• generating and displaying a table including definitions of a plurality of rules, each of said definitions including an entry for a source IP address of a permitted but misconfigured data flow, an entry for a destination IP address of the permitted but misconfigured data flow, and an entry for a protocol or destination port of said permitted but misconfigured data flow, wherein the generating and displaying includes:
• color coding said source IP address entry in said table to indicate a security level of a source network containing said source IP address;
• and
• color coding said destination IP address entry in said table to indicate a security level of a destination network containing said destination IP address.

A computer program product for reporting data flow misconfigurations in a firewall, said computer program product comprising:

• a computer readable medium;
• first program instructions to generate and display a table including definitions of a plurality of rules, each of said definitions including an entry for a source IP address of a permitted but misconfigured data flow, an entry for a destination IP address of the permitted but misconfigured data flow, and an entry for a protocol or destination port of said permitted but misconfigured data flow, wherein said first program instructions include:
• second program instructions to color code said source IP address entry in said table to indicate a security level of a source network containing said source IP address;
• and
• third program instructions to color code said destination IP address entry in said table to indicate a security level of a destination network containing said destination IP address;
• and wherein
• said first, second and third program instructions are recorded on said medium.