# US 2018/0026944 A1 · Assessing risk associated with firewall rules > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026944 A1 - Document ID: US20180026944A1 - Status: Published application - Kind: A1 - Application number: 15/215,792 - Filed: 2016-07-21 - Published: 2018-01-25 - Earliest claimed: 2016-07-21 - Assignees: AT&T Global Network Services (UK) B.V. - Applicants: AT&T Global Network Services (U.K.) B.V. - Inventors: Ian Phillips - Web page: https://patentgrep.com/patent/US20180026944A1 ## CPC - H04L 63/0263: {Rule management} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for assessing risk associated with firewall rules are provided. In one implementation, a method includes receiving a request for the network to apply a firewall policy rule to control traffic to a machine associated with the network, wherein the firewall policy rule comprises information that identifies a remote address from which the traffic can originate and a type of the traffic. The method further includes determining a remote address risk value representative of a first degree of security risk associated with allowing the traffic to access the machine in response to the traffic being determined to originate from the remote address; determining a traffic type risk value representative of a second degree of security risk associated with allowing the type of traffic to access the machine; and determining a total risk value based on a combination of the remote address risk value and the traffic type risk value. ## Claims ### Claim 1 A method, comprising: receiving, by a device of a network and comprising a processor, a request for the device of the network to apply a firewall policy rule to control traffic to a machine of the network, wherein the firewall policy rule comprises information that identifies a remote address from which the traffic is able to originate and a type of the traffic; and analyzing, by the device, the information based on the request, comprising: determining a remote address risk value representative of a first degree of security risk associated with allowing the traffic to access the machine in response to the traffic being determined to originate from the remote address; determining a traffic type risk value representative of a second degree of security risk associated with allowing the type of the traffic to access the machine; and determining a total risk value based on a result of a combination of the remote address risk value and the traffic type risk value. ### Claim 2 (depends on 1) The method of claim 1, wherein the determining the remote risk value comprises determining the remote risk value based on a number of subnet addresses associated with the remote address, and wherein the remote address risk value increases as the number of the subnet addresses increases. ### Claim 3 (depends on 1) The method of claim 1, wherein the determining the remote risk value comprises: identifying the remote address in a data store comprising risk information identifying degrees of security risk respectively associated with known remote addresses; and determining the remote address risk value based on the risk information. ### Claim 4 (depends on 3) The method of claim 3, wherein a first known remote address of the remote addresses included in the network is associated with a lower degree of security risk relative to a second known remote address of the remote addresses excluded from the network. ### Claim 5 (depends on 1) The method of claim 1, wherein the type or the traffic comprises protocol and port combinations, wherein the determining the traffic type risk value comprises determining the traffic risk value based on a number of the protocol and port combinations, and wherein the traffic type risk value increases as the number of the protocol and port combinations increases. ### Claim 6 (depends on 1) The method of claim 1, wherein the determining the traffic type risk value comprises: identifying the traffic in a data store comprising risk information identifying degrees of security risk respectively associated with known types of traffic; and determining the traffic type risk value based on the risk information. ### Claim 7 (depends on 6) The method of claim 6, wherein an encrypted type of traffic is associated with a lower degree of risk relative to a non-encrypted type of traffic. ### Claim 8 (depends on 1) The method of claim 1, wherein the machine comprises a virtual machine, and wherein the network comprises a virtual service provider network. ### Claim 9 (depends on 1) The method of claim 1, further comprising: determining, by the device, whether the firewall policy rule is associated with an acceptable degree of security risk based on a comparison of the total risk value with a threshold risk value. ### Claim 10 (depends on 9) The method of claim 9, further comprising: directing, by the device, a network device of the network to apply the firewall policy rule to control access of the traffic to the machine in response to a determination that the firewall policy rule is associated with the acceptable degree of security risk. ### Claim 11 (depends on 9) The method of claim 9, further comprising: notifying, by the device, a user identity associated with ownership of the machine that the firewall policy rule is not associated with the acceptable degree of security risk based on a determination that the firewall policy rule is not associated with the acceptable degree of security risk. ### Claim 12 (depends on 9) The method of claim 9, further comprising: denying, by the device, authorization to apply the firewall policy rule to control access of the traffic to the machine in response to a determination that the firewall policy rule is not associated with the acceptable degree of security risk. ### Claim 13 A system comprising: a processor; and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising: analyzing firewall policy information defining traffic authorized to be sent from a machine of a network, the firewall policy information identifying a remote address for a destination to which the traffic is capable of being sent and a type of the traffic, wherein the analyzing comprises: determining a remote address risk value representative of a first degree of security risk associated with allowing the traffic to be sent from the machine to the destination associated with the remote address; determining a traffic type risk value representative of a second degree of security risk associated with allowing the type of traffic to be sent from the machine; and determining a total risk value based on a function of the remote address risk value and the traffic type risk value; and directing a network device of the network to apply the firewall policy information to control access of the traffic to the machine in response to a first determination that the firewall policy information is associated with an acceptable degree of security risk based on the total risk value being less than a threshold risk value. ### Claim 14 (depends on 13) The system of claim 13, wherein the operations further comprise: determining the remote risk value based on a number of subnet addresses associated with the remote address, and wherein the remote address risk value increases as the number of the subnet addresses increases. ### Claim 15 (depends on 13) The system of claim 13, wherein the operations further comprise: identifying the remote address in a data store comprising risk information identifying degrees of security risk respectively associated with known remote addresses, and determining the remote address risk value based on the risk information. ### Claim 16 (depends on 13) The system of claim 13, wherein the type of the traffic comprises protocol and port combinations, wherein the operations further comprise determining the traffic risk value based on a number of the protocol and port combinations, and wherein the traffic type risk value increases as the number of the protocol and port combinations increases. ### Claim 17 (depends on 13) The system of claim 13, wherein the operations further comprise: identifying the traffic in a database comprising risk information identifying degrees of security risk respectively associated with known types of traffic; and determining the traffic type risk value based on the risk information. ### Claim 18 (depends on 13) The system of claim 13, wherein the operations further comprise: denying the network device of the network authorization to apply the firewall policy information to control the access of the traffic to the machine in response to a second determination that the firewall policy information is not associated with the acceptable degree of security risk based on the total risk value being greater than the threshold value. ### Claim 19 A machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising: evaluating a firewall policy rule defining traffic authorized to access a machine of a network, the firewall policy rule comprising information identifying a remote address from which the traffic originates and a type of the traffic, wherein the evaluating comprises: determining a remote address risk value representative of a first degree of security risk associated with allowing the traffic to access the machine when originating from the remote address; determining a traffic type risk value representative of a second degree of security risk associated with allowing the type of traffic to access the machine; and determining a total risk value based on a combination of the remote address risk value and the traffic type risk value; and rejecting the firewall policy rule based on a determination that the firewall policy rule is associated with an unacceptable degree of security risk based on a comparison of the total risk value with a threshold risk value. ### Claim 20 (depends on 19) The machine-readable storage medium of claim 19, wherein the machine comprises a virtual machine and wherein the network comprises a virtual service provider network.