Insecure Firewalls: FortiGate Configuration Trends Revealed
FortiGate configuration trends identified across multiple recent incident investigations
STORM has identified recurring weaknesses in FortiGate configuration and maintenance across multiple recent incident investigations.
These weaknesses can turn an internet-facing security device into a route into the corporate network.
In some incidents, exposed management interfaces and weak account controls were subject to brute-force activity, followed by unauthorised access to the corporate network. The recurring pattern is a combination of access, privilege, logging and maintenance gaps.
Observed pathway in investigations
1 EXPOSURE | 2 ATTACK | 3 ACCESS |
Management interfaces accessible from the internet | Brute-force activity against weak account controls | Unauthorised entry to the corporate network |
Configuration trends identified
Access and account controls
Management or administrative interfaces exposed to the internet.
Stale or test accounts left active on the firewall.
No multi-factor authentication for administrators or VPN users.
No account-lockout policy or alerting policy after repeated failed login attempts.
Network access
Overly permissive egress policy rules allow unnecessary communication between network segments.
VPN users can reach segments without a defined business need or justification.
Least privilege is not applied consistently to administrative, network and remote access.
Policy rules using broad “any” objects for protocols or services reduce granular control and may permit unnecessary traffic.
Logging and maintenance
Logging is insufficient to support monitoring and an effective incident investigation.
Retention of logs is often inadequate to support an incident investigation.[HG1.1]
Firewall firmware is not current and may remain exposed to vulnerabilities associated with older versions.
Update cadence is based on a fixed routine rather than the risk posed by each security update. This is often an issue seen with third-party managed firewalls.
The purpose of this advisory is awareness.
Organisations should review the security outcome of the service they receive and work constructively with their providers to correct weaknesses. Organisations remain accountable for ensuring that their systems are maintained in line with their risk appetite and applicable obligations. It is ultimately the responsibility of the end organisation to ensure that the systems are maintained in-line with their risk appetite and obligations.
Update strategy and response priorities
Why fixed update cycles are no longer sufficient
Some organisations still delay firewall security updates until a monthly or quarterly maintenance window. On an internet-facing security device, that delay can leave known vulnerabilities unaddressed while the risk is already active.
Security teams should monitor relevant advisories and updates daily, assess each update against exposure and business risk, and apply critical security updates as soon as practicable after testing. The decision should follow a risk-based approach, rather than a routine calendar.
Shared responsibility with service providers
Organisations remain accountable for their environment even when an IT service provider or managed security service provider operates the firewall. Contracts should state who monitors advisories, applies updates, reviews configurations, retains logs and responds to suspected compromise.
Recommended actions
Commission an independent review of the firewall configuration and administrative exposure.
Confirm that management interfaces are not unnecessarily internet-accessible and restrict approved administrative source addresses.
Remove stale and test accounts. Review every account, role and access path. These reviews should be performed regularly.
Enforce multi-factor authentication (MFA) for administrators and VPN users.
Configure an account lockout policy after a defined number of failed attempts and generate alerts.
Review policy rules, network segmentation and VPN permissions. Apply least privilege.
Verify that logging supports daily monitoring, alerting and incident investigation.
Ensure firmware is up to date. Assess critical updates promptly and apply them as soon as practicable after testing.
Make responsibility for configuration, patching, monitoring and incident response explicit in ITSP and MSSP contracts.
When to escalate
Seek immediate incident response support if logs show unexpected administrator activity, successful brute-force access, unauthorised configuration changes or signs that the firewall or connected network is compromised.
How STORM can help
Start with Cyber3. Cyber3 is STORM's rapid, expert-led risk review. It helps organisations identify priority gaps and decide what to address first. For assurance on the FortiGate configuration itself, ask STORM to scope an independent firewall security review.
Speak with the STORM team.
