Offensive Security

Firewall Configuration Review

A systematic review of your firewall and network device configurations against recognised benchmarks and your own segmentation policy. We find the permissive rules, the gaps, and the orphaned entries.

Book a scope call All Offensive Security Services

Overview

Firewall rulesets accumulate over years. Rules added for a project, an exception, or a long-departed system rarely get removed. The result is an attack surface that quietly widens with every change, and a configuration that no longer reflects your actual segmentation intent. A firewall configuration review is one of the most cost-effective ways to reduce risk and improve your security posture without touching a single line of application code.

A firewall configuration review examines the full rule set and device hardening offline, against recognised industry standards and your documented firewall policies. We look for overly permissive rules, any-any permits, redundant or shadowed rule changes, weak management-plane access, outbound controls that are absent or misconfigured, and segmentation gaps that leave sensitive zones exposed. The review covers misconfigurations that automated tools and penetration tests alone do not systematically surface. We validate access control, confirm internal network isolation, and check configure settings against security best practices.

We deliver prioritised, practical hardening recommendations. Implementing those changes inside your environment is carried out by your team or your managed provider, with our guidance available throughout. This review provides audit-ready evidence for PCI DSS, HIPAA, GDPR, and other regulatory requirements that mandate regular firewall review and demonstrable segmentation.

What’s included

Review of firewall and network device configurations
Ruleset analysis: permissive, redundant, shadowed, and unused rules
Segmentation and zoning validation (including cardholder data environment isolation)
Management-plane and administrative access hardening review
Benchmarking against recognised hardening standards
Prioritised remediation recommendations

How we work

01
Collect configurations
We securely collect device configurations and your documented segmentation policy and intent.
02
Analyse the ruleset
We review the firewall rule base and device hardening offline against security best practices and your firewall policies, without touching live systems.
03
Validate segmentation
We confirm that network zones, including any cardholder data environment, are isolated as your policy intends and that access control is enforced on both inbound and outbound traffic.
04
Recommend
We deliver a prioritised, actionable list of hardening changes with the rationale for each, covering potential security vulnerabilities and the configuration reviews most likely to reduce risk.

What you get

Firewall configuration review report
Ruleset findings with risk ratings
Segmentation validation results
Prioritised hardening recommendations

Frequently asked questions

Does a firewall configuration review satisfy PCI DSS requirements?

PCI DSS requires regular firewall and network device ruleset reviews and demonstrable segmentation of the cardholder data environment. This review provides both the audit evidence and the prioritised findings for your remediation team to act on. It also supports HIPAA and GDPR programmes that require network security controls and access control documentation.

Do you make changes to our firewall?

We review configurations and produce recommendations. Implementing changes inside your environment is done by your team or your managed provider. We can advise during that process if needed.

How do you access our configurations without touching production systems?

We work from exported configuration files you provide, reviewed offline. No direct access to live firewalls is required for the firewall review itself.

What is the difference between a firewall audit and a firewall configuration review?

A firewall audit is typically a broader compliance process that checks whether firewall management procedures, change control, and documentation meet a standard. A firewall configuration review focuses on the technical detail of the rule set and device hardening. The two complement each other. This service is the technical review: if you need a full firewall audit process as part of a compliance programme, we can scope both together.

See the kind of report you get

Every engagement ends with a report you can act on: an executive summary, CVSS-aligned findings, reproduction evidence, and prioritised fixes. Ask for a redacted sample and we will share one.

Request a sample report