Modern IT environments change constantly. System updates, new applications, infrastructure migrations, and even routine administrative changes can unintentionally introduce misconfigurations or weaken security postures.
A firewall that was secure last quarter may now be exposing services, ports, or rules it shouldn't.
These assessments validate that network devices, access controls, and security configurations are properly aligned with best practice, and that no hidden vulnerabilities are waiting to be exploited.
For highly regulated sectors like finance and healthcare, regular configuration reviews aren't just best practice; they're often mandatory under compliance frameworks.
Identify weak, outdated, or overly permissive firewall rules
Validate patch levels and firmware versions across security appliances
Ensure access controls and authentication settings meet policy standards
Detect unauthorised or undocumented changes to critical infrastructure
We recommend conducting firewall and infrastructure reviews at least semi-annually, or more frequently in high-risk or change-heavy environments.
Our reviews are methodical, transparent, and tailored to your infrastructure. Each assessment typically includes:
Documenting all firewalls in scope, including make, model, and deployment context (e.g., perimeter, internal, cloud)
Analysing rule sets for redundancies, insecure exceptions, unused rules, or over-permissive access
Assessing your change control processes to ensure firewall updates are governed and logged correctly
Verifying admin access, RBAC configurations, and integration with identity providers
Evaluating event logging, SIEM integration, and alert mechanisms
Confirming firewalls are running supported software with all critical updates applied
You should consider a configuration review if:
While configuration reviews are a powerful control, they should be part of a wider risk management strategy. We recommend pairing them with:
To simulate real-world attacks and validate configurations under stress
To evaluate your overall cyber risk posture and control effectiveness
To identify known software and system weaknesses in real time