Firewall Configuration & Rule Review by Dragos Moruz

Firewall Configuration & Rule Review

Dragos Moruz

Contact for pricing

About this service

Summary

I provide in-depth firewall security assessments to evaluate rule sets, configuration practices, and overall posture across on-premises and cloud-based firewalls. This service ensures that your firewall is optimized to enforce least privilege, prevent unauthorized access, and align with security best practices such as CIS Benchmarks, NIST SP 800-41, and Zero Trust Architecture.

Process

Scope Definition

Identify in-scope firewalls (e.g., perimeter, internal, cloud-native firewalls like Azure NSGs, AWS Security Groups)

Define assessment goals: rule audit, segmentation review, configuration hardening

Data Collection

Export and collect firewall configurations and rule sets

Gather network architecture diagrams, asset inventories, and access control policies

Interview relevant teams for context around rule intent and exceptions

Configuration & Rule Analysis

Evaluate rules for overly permissive access, shadowed/unused rules, and misconfigurations

Assess rule base for alignment with least privilege, network segmentation, and service-specific access

Analyze logging, alerting, and update/patch practices

Reporting & Documentation

Deliver a detailed firewall review report including:

Misconfigured or high-risk rules

Redundant or conflicting rules

Gaps in rule documentation and change control

Recommendations for rule optimization and configuration hardening

Remediation Support & Validation

Provide actionable remediation guidance

Support implementation of rule and config changes

Optionally perform post-remediation validation and retesting

FAQs

Why should I review my firewall rules if everything is working fine?
Even if your network appears secure, firewall rules can become outdated, overly permissive, or redundant over time. A review ensures rules follow least privilege principles, reduce your attack surface, and comply with security frameworks like CIS and NIST.
Will the firewall review cause any downtime or impact my systems?
No. The firewall review is non-intrusive and based on configuration exports and documentation. There is no need to make live changes during the assessment, so your production systems remain unaffected.
What’s included in the final report?
You’ll receive a comprehensive report that includes: A summary of current firewall posture Identification of risky, unused, or misconfigured rules Recommendations for optimization Compliance alignment (e.g., CIS, Zero Trust) Diagrams or visuals (if applicable)
Do you help with fixing the issues found?
Yes. I provide detailed remediation guidance and, if needed, hands-on support or collaboration with your network/security team to safely implement changes. I also offer validation testing after changes are made.

What's included

Applying industry standards
Firewall rule audit report with security findings and risk categorization
Optimization and support
Rule optimization recommendations and change planning support
Compliance alignment
Compliance alignment overview (CIS, NIST, Zero Trust principles)
Reporting
Executive summary and technical appendix for both leadership and engineering teams

Example projects

Firewall Configuration & Rule Review

Comprehensive Penetration Testing Services

Web application pentesting for Evoque Group

Recommendations

(5.0)

Stefan Cristescu • Verifone

Client • May 5, 2025

Recommended

Dragos was punctual and efficient from the start. Briefed just hours after our first contact, he was already testing the system. His structured, methodical approach was exactly what I needed under pressure. He spotted a subtle token reuse issue in an API flow that could’ve allowed unintended replays and proposed a clean, practical fix. I implemented it, and we were fully operational in three days. I recommend him to anyone needing top-tier, organized, hassle-free penetration testing.

Andreea Fiterău

Client • May 5, 2025

Recommended

Working with Dragos was an outstanding experience. His expertise in cybersecurity is matched only by his exceptional communication skills. He explained complex concepts in a way that was clear, practical, and easy to follow. I always felt informed and supported throughout the process. I highly recommend him—10/10!

Skills and tools

Cloud Security Engineer

Security Engineer

Security Manager