NETWORK ACCESS LIFECYCLE: A STRUCTURED APPROACH TO FIREWALL RULE GOVERNANCE IN ZERO TRUST ENVIRONMENTS

Abstract

This paper reflects on the consequences of uncontrolled network access rule configurations within corporate networks and examines the risks resulting from their chaotic accumulation. To monitor and manage security policies and access control lists (ACLs), the introduction of a network access lifecycle is proposed as a unified methodology for the creation, operational support, and deactivation of access rights within corporate infrastructure. The study outlines mandatory structural stages and their sequence, investigating the methodology for their implementation while specifying the necessary components and attributes for each stage of the network access lifecycle. The methodological foundation of the proposed approach consists of a combination of firewall and policy guidelines described in NIST SP 800-41 rev. 1, Zero Trust principles outlined in NIST SP 800-207, and original authorial methodologies for organizing the access lifecycle and developing recertification procedures. Managed support for the "birth," life, and termination of access rules in corporate network environments is a distinct process. It allows for the tracking and regulation of open ports in firewalls, ACL application points, security groups, and access rules in cloud network entities to ensure their relevance at any given time, compliance with initial requirements, and adherence to Zero Trust principles. The article proposes a methodology for conducting periodic reviews and recertification of security policies as a fundamental stage of the network access lifecycle. The approach includes an algorithm for determining recertification periods, a structural framework for evaluation criteria and rule validation, and a defined list of potential decisions regarding the objects under review. The importance of automation in managing access rules is described, alongside the specific benefits it provides. The implementation of tagging is proposed as an effective mechanism for structuring rules in large-scale environments. Furthermore, the paper emphasizes the necessity of following a naming convention when creating security policies in distributed and hybrid infrastructures.