 after their existing security has been compromised. Others may be forced into compliance by regulations like Sarbanes-Oxley. If you find yourself designing a security solution, you should follow these best practices: Simple is good This rule applies to all of networking, but it is especially relevant for security rules. When you are designing security rules and configuring firewalls, keep it simple. Make your rules easy to read and understand. Where applicable, use names instead of numbers. Monitor the logs You must log your firewall status messages to a server, and you must look at these messages on a regular basis. If you have a firewall in place, and you're not examining the logs, you are living with a false sense of security. Someone could be attacking your network right now, and you'd have no idea. I've worked on sites that kept buying more Internet bandwidth, amazed at how much they needed. When I examined their firewall logs, I discovered that the main band- width consumers were warez sites that hackers had installed on their internal FTP servers. Because no one looked at the logs, no one knew there was a problem. Deny everything; permit what you need This is a very simple rule, but it's amazing how often it's ignored. As a best practice, this has got to be the one with the biggest benefit. In practical terms, blocking all traffic in both directions is often viewed as too troublesome. This rule should always be followed to the letter on inbound Chapter 25: Firewall Theory firewalls-nothing should ever be allowed inbound unless there is a valid, documented business need for it. Restricting all outbound traffic except that which is needed is also the right thing to do, but it can be an administrative has- sle. Here is a prime example of convenience outweighing security. On the plus side, if you implement this rule, you'll know that peer-to-peer file sharing services probably won't work, and you'll have a better handle on what's going on when users complain that their newly installed instant-messenger client