What evidence should be preserved before and after a policy change in Blockbit NGFW?
Hey, guys.
I work with management system documentation and maintain the isochecklist.com website. I am studying how to structure a process of controlling changes to firewalls, especially when changes need to remain traceable for internal audits, investigation of incidents or customer requirements.
I still don't manage Blockbit in a production environment, so I don't want to assume the platform has resources that I haven't tested yet.
In a critical change, such as the creation or modification of a firewall rule, NAT, SSL inspection, application control, VPN or access policy, I imagine that the minimum record should allow you to respond later:
- what was the previous configuration;
- exactly what has been changed;
- who made the amendment;
- when the change was applied;
- who authorized the change;
- which tests were performed;
- if there was an unexpected impact;
- which configuration would be used for rollback;
- whether the change was subsequently modified or reversed.
My main question is which evidence can be obtained directly from Blockbit NGFW or centralized management.
What is the recommended method to preserve a reliable history of before and after policy changes in Blockbit NGFW?
The platform offers some native resource to:
- compare configuration versions;
- identify the responsible administrator;
- record date and time of change;
- export or restore a specific configuration;
- relating the change to a request or approval;
- later check which rules were active at a certain time?
If there is not a single feature that covers the entire process, would it be safer to combine configuration backup, administrative logs and referral by Syslog to a solution like Wazuh or another SIEM?
To contextualize the perspective of management and evidence that motivated the question, I keep this page on information security management and audit evidence according to ISO 27001. The page is my own, it's in English and it's not Blockbit documentation.
I have an interest in both a native platform solution and a simpler and more reliable external method.
After testing the recommendations, I intend to add to the topic a summary structure of the records that worked best.
