Firewall & Configuration Assessment Services

Your firewall is only as strong as its ruleset - when did you last review it?

Firewall rules accumulate over years. Legacy permits, overly broad allow entries, and undocumented exceptions quietly undermine your perimeter. AMATAS firewall and configuration assessment identifies every gap – across firewalls, network devices, cloud security groups, and the policies that govern them.

Firewalls and network devices are configured once and rarely reviewed with the scrutiny they deserve. Rules added for temporary access that never got removed. Broad permit rules added under time pressure that were never narrowed. Default credentials left on network switches. Management interfaces exposed to wider network segments than intended. Configuration drift is inevitable – and it creates the gaps attackers walk through. AMATAS firewall and configuration assessment takes a systematic, expert-led approach to reviewing your entire network device estate against security best practices and your own stated security policy – giving you a clear, prioritized picture of what needs to change.

Scope

What we assess

Configuration weaknesses exist at every layer of your network device estate – we review all three.

Firewalls & perimeter security

Expert review of firewall rulesets, zone policies, and perimeter security configurations across your on-premise and cloud firewall infrastructure.

Ruleset review & cleanup recommendations
Overly permissive & legacy rule identification
Zone policy & inter-zone traffic review
Management interface access controls
NAT & VPN configuration review

Network devices

Configuration review of switches, routers, and network infrastructure against CIS Benchmarks and hardening best practices.

Default credential & account review
Unused services & protocol disabling
VLAN & trunk port configuration
Management protocol security (SSH, SNMP)
Firmware version & patch status

Cloud security groups & WAF

Review of cloud-native security controls – AWS security groups, Azure NSGs, GCP firewall rules, and WAF configurations.

Overly permissive inbound/outbound rules
WAF rule coverage & bypass testing
Cloud-native firewall policy review
Cross-account & cross-VPC rule review

What we find

Common findings from firewall & configuration assessments

Legacy permit rules

Allow rules added for temporary access years ago that were never removed – silently permitting traffic that should long since have been blocked.

Overly broad rules

Rules that permit entire IP ranges or all ports when only specific hosts and services were intended – far wider than operationally required.

Exposed management interfaces

SSH, HTTP management, SNMP, and Telnet accessible from network segments where they should be restricted to dedicated management networks only.

Default & weak credentials

Network devices still using manufacturer default credentials or weak passwords – one of the most commonly exploited misconfigurations in internal networks.

Configuration drift

Devices that have deviated from your hardening baseline over time – accumulated through operational changes, emergency fixes, and undocumented modifications.

Insecure protocols

Telnet, HTTP management, SNMPv1/v2, and other protocols that transmit credentials and configuration data in cleartext – still active on network devices.

Assessment areas

What every engagement covers

Ruleset analysis

Line-by-line review of firewall rulesets – identifying redundant, overly permissive, shadowed, and legacy rules across all policy zones.

Security policy review

Assessment of your firewall and network security policies against your stated security requirements and industry best practice standards.

Hardening assessment

Comparison of device configurations against CIS Benchmarks and vendor hardening guides – identifying deviations and missing controls.

Access control review

Review of administrative access – who can access devices, from where, using what protocols, and with what level of privilege.

Patch & firmware status

Identification of outdated firmware and software versions across your network device estate – flagging known vulnerabilities requiring remediation.

Logging & monitoring

Review of logging configuration – confirming that firewall and device events are captured, forwarded, and retained in line with your security requirements.

When to use it

The right moments for a firewall & configuration assessment

Annual review

Firewall rules accumulate over time – an annual review keeps your ruleset clean, accurate, and aligned with your current security requirements.

Post-merger or acquisition

Before integrating an acquired company’s network – assess their firewall and device configurations before connecting to your environment.

Compliance preparation

PCI DSS, ISO 27001, and DORA all require evidence of secure network device configuration – prepare before your audit.

Change of network team

When network ownership changes hands – understand what you’ve inherited and establish a clean, documented baseline.

Compliance support

Regulatory frameworks this service supports

Firewall and configuration review is a direct requirement or strongly recommended control across the following frameworks.

FAQ

Firewall & configuration assessment - common questions

How is a firewall assessment different from a penetration test?

A penetration test actively attempts to exploit vulnerabilities – including firewall misconfigurations – from the attacker’s perspective. A firewall and configuration assessment is a review-based engagement that analyzes your ruleset and device configurations directly, identifying issues at the configuration level before they can be exploited. Both are complementary – the configuration assessment finds what’s wrong in the ruleset; the penetration test confirms what’s exploitable from the outside.

Do you need access to our firewall management interface to conduct the assessment?

We require access to your firewall ruleset and device configurations, which can be provided through a secure configuration export rather than direct management access. For most engagements, your team exports the relevant configuration files and shares them with us through an encrypted, access-controlled channel. Where direct read-only access is preferable, we can accommodate that as well – the access method is agreed during scoping.

Our firewall vendor provides its own security assessment tools - why do we need an external review?

Yes – vendor-provided tools assess technical compliance with their platform’s configuration recommendations, but they don’t evaluate whether your ruleset aligns with your actual security requirements, your network segmentation design, or the compliance frameworks you’re subject to. An independent external review provides objective assurance that your configuration is not only technically correct but also appropriate for your environment and risk profile – which is what auditors and regulators require.

Ready to review your firewall and network device configurations?

Talk to our team – we’ll scope the right assessment for your infrastructure, compliance requirements, and timeline.

Often combined with cloud penetration testing

Network Penetration Testing

Active exploitation testing that validates what’s actually reachable through your firewall – beyond what the ruleset review shows.

Network Segmentation Testing

Traffic-based testing that confirms your firewall rules enforce the intended zone isolation in practice.

Cloud Penetration Testing

Cloud-native penetration testing that goes beyond security group review to test what’s exploitable in your cloud environment.