any inconvenience. More often than not, companies do come to an understanding that they need a certain level of security, even if some conveniences must be sacrificed for its sake. Sadly, for many companies, this happens only after their existing security has been compromised. Others may be forced into compliance by regulations like Sarbanes-Oxley and PCI. If you find yourself designing a security solution, you should follow these best practices: Simple is good This rule applies to all of networking, but it is especially relevant for security rules. When you are designing security rules and configuring firewalls, keep it simple. Make your rules easy to read and understand. Where applicable, use names instead of numbers. If your firewall has 60,000 rules in it, I'd be willing to bet you've got holes. And yes, there are plenty of firewalls out there with tens of thousands of rules. Monitor the logs You must log your firewall status messages to a server, and you must look at these messages on a regular basis. If you have a firewall in place and you're not examining the logs, you are living with a false sense of security. Someone could be attacking your network right now and you'd have no idea. I've worked on sites that kept buying more Internet bandwidth, amazed at how much they needed. When I ex- amined their firewall logs, I discovered that the main bandwidth consumers were warez sites that hackers had installed on their internal FTP servers. Because no one looked at the logs, no one knew there was a problem. Chapter 27: Basic Firewall Theory Deny everything; permit what you need This is a very simple rule, but it's amazing how often it's ignored. As a best practice, this has got to be the one with the biggest benefit. In practical terms, blocking all traffic in both directions is often viewed as too troublesome. This rule should always be followed to the letter on inbound firewalls-nothing should ever be allowed inbound unless there is a valid, docu- mented business need for it. Restricting all outbound traffic e