| Identifying source address for information flows within the network allows forensic reconstruction of events when required, and increases policy compliance by attributing policy violations to specific individuals. Means to enforce this enhancement include ensuring the network element authenticates the source involved in sending information.
Firewall policies or rules may be configured to allow a source subnet or IP address range, and a possible destination of ANY, but the monitoring, logging, and auditing mechanism must identify the specific source and destination IP addresses and ports/protocols and, if configured, the source and destination DNS.
Examples of information transfer for the firewall are communications with the router, IPS, or central logging server. Without unique identifiers, the audit records of these information transfers would not be useful when tracking possible violations. |
