# US 2019/0173845 A1 · Assessing risk associated with firewall rules > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173845 A1 - Document ID: US20190173845A1 - Status: Published application - Kind: A1 - Application number: 16/260,261 - Filed: 2019-01-29 - Published: 2019-06-06 - Earliest claimed: 2016-07-21 - Assignees: AT&T Global Network Services (UK) B.V. - Applicants: AT&T Global Network Services (U.K.) B.V. - Inventors: Ian Phillips - Web page: https://patentgrep.com/patent/US20190173845A1 ## CPC - H04L 63/0263: {Rule management} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for assessing risk associated with firewall rules are provided. In one implementation, a method includes receiving a request for the network to apply a firewall policy rule to control traffic to a machine associated with the network, wherein the firewall policy rule comprises information that identifies a remote address from which the traffic can originate and a type of the traffic. The method further includes determining a remote address risk value representative of a first degree of security risk associated with allowing the traffic to access the machine in response to the traffic being determined to originate from the remote address; determining a traffic type risk value representative of a second degree of security risk associated with allowing the type of traffic to access the machine; and determining a total risk value based on a combination of the remote address risk value and the traffic type risk value. ## Claims ### Claim 1 A method, comprising: determining, by a device operatively coupled to a processor, a security risk score that reflects a level of risk of a security rule for control of communication of a machine of a network, wherein the security rule indicates a remote address with which the machine is able to communicate and a type of traffic for the communication, and wherein the determining the security risk score comprises: determining a remote address risk value representative of a first degree of security risk associated with the remote address, determining a traffic type risk value representative of a second degree of security risk associated with the type of traffic, and determining the security risk score as a function of a combination of the remote address risk value and the traffic type risk value; and determining, by the device, whether to apply the security rule to control the communication of the machine based on an acceptability criterion for the security risk score. ### Claim 2 (depends on 1) The method of claim 1, wherein the determining the security risk score comprises determining the security risk score based on a vector determined as the function of the combination of the remote address risk value and the traffic type risk value. ### Claim 3 (depends on 1) The method of claim 1, wherein the communication comprises ingress communication from the remote address to the machine. ### Claim 4 (depends on 1) The method of claim 1, wherein the communication comprises egress communication from the machine to the remote address. ### Claim 5 (depends on 1) The method of claim 1, wherein the machine comprises a virtual machine, wherein the network comprises a virtual network, and wherein the security rule controls passage of traffic through a virtual network controller that connects the virtual machine to the virtual network. ### Claim 6 (depends on 1) The method of claim 1, further comprising: directing, by the device, a network interface controller of the network to apply the security rule to control the communication of the machine based on a determination that the security risk score satisfies the acceptability criterion. ### Claim 7 (depends on 1) The method of claim 1, further comprising: rejecting, by the device, the security rule based on a determination that the security risk score fails to satisfy the acceptability criterion. ### Claim 8 (depends on 1) The method of claim 1, wherein the determining the remote address risk value comprises determining the remote address risk value based on a number of subnet addresses associated with the remote address, and wherein the remote address risk value increases as the number of the subnet addresses increases. ### Claim 9 (depends on 1) The method of claim 1, wherein the determining the remote address risk value comprises: identifying the remote address in a data store comprising risk information identifying degrees of security risk respectively associated with known remote addresses; and determining the remote address risk value based on the risk information. ### Claim 10 (depends on 1) The method of claim 1, wherein the type of traffic corresponds to different protocol and port combinations, wherein the determining the traffic type risk value comprises determining the traffic risk value based on a number of the different protocol and port combinations, and wherein the traffic type risk value increases as the number of the different protocol and port combinations increases. ### Claim 11 (depends on 1) The method of claim 1, wherein the determining the traffic type risk value comprises: identifying the type of traffic in a data store comprising risk information that identifies degrees of security risk respectively associated with known types of traffic; and determining the traffic type risk value based on the risk information. ### Claim 12 A system comprising: a processor; and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising: determining a security risk score that reflects a level of risk of a security rule for controlling communication of a machine of a network, wherein the security rule indicates a remote address with which the machine is able to communicate and a type of traffic for the communication, and wherein the determining the security risk score comprises: determining a remote address risk value representative of a first degree of security risk associated with the remote address; determining a traffic type risk value representative of a second degree of security risk associated with the type of traffic; and determining the security risk score as a function of a combination of the remote address risk value and the traffic type risk value; and determining whether to apply the security rule to control the communication of the machine based on an acceptability criterion for the security risk score. ### Claim 13 (depends on 12) The system of claim 12, wherein the determining the security risk score comprises determining the security risk score based on a vector determined as the function of the combination of the remote address risk value and the traffic type risk value. ### Claim 14 (depends on 12) The system of claim 12, wherein the communication comprises ingress communication from the remote address to the machine. ### Claim 15 (depends on 12) The system of claim 12, wherein the communication comprises egress communication from the machine to the remote address. ### Claim 16 (depends on 12) The system of claim 12, wherein the machine comprises a virtual machine, wherein the network comprises a virtual network, and wherein the security rule controls passage of traffic through a virtual network controller that connects the virtual machine to the virtual network. ### Claim 17 (depends on 12) The system of claim 12, wherein the operations further comprise: directing a network interface controller of the network to apply the security rule to control the communication of the machine based on a determination that the security risk score satisfies the acceptability criterion. ### Claim 18 (depends on 12) The system of claim 12, wherein the operations further comprise: rejecting the security rule based on a determination that the security risk score fails to satisfy the acceptability criterion. ### Claim 19 A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising: determining a security risk score that reflects a level of risk of a security rule for controlling communication of a machine of a network, wherein the security rule indicates a remote address with which the machine can communicate and a type of traffic for the communication, and wherein the determining the security risk score comprises: determining a remote address risk value representative of a first degree of security risk associated with the remote address; determining a traffic type risk value representative of a second degree of security risk associated with the type of traffic; and determining the security risk score as a function of a combination of the remote address risk value and the traffic type risk value; and determining whether to apply the security rule to control the communication of the machine based on an acceptability criterion for the security risk score. ### Claim 20 (depends on 19) The non-transitory machine-readable storage medium of claim 19, wherein the determining the security risk score comprises determining the security risk score based on a vector determined as the function of the combination of the remote address risk value and the traffic type risk value.