The Most Common Cause of a Cyber Breach Misconfigured Firewalls

Sanjay Seth, P J Networks Pvt Ltd
This is my third cup of coffee in, and I’m buzzing, not just from caffeine but from an 80s 90s experience that just flew past my eyes. August nonetheless comes across like an aging star who doesn’t quite know when to quit — I’ve been in the game since 1993, starting as a network admin battling voice and data mux on PSTN lines and saw the devastation the Slammer worm could inflict in plain sight. The days had taught me a simple fact, a truth: No matter how great your tech is, if your firewall is misconfigured, you are really leaving the gate completely open for the cybercriminals.

Today, while running my own cybersecurity consultancy, P J Networks, I continue to see the same rookie mistakes resulting in some of the most devastating breaches. Just recently, we assisted three large banks in redesigning their zero trust architectures, and I can confirm that the only weak point in the setup were broken firewalls.

In fact, I just got back from DefCon’s hardware hacking village and I’m still riding that high. However, all that LED flashing glory aside, one thing is crystal clear: the cause of most cyber breaches remains the same, firewall misconfigurations.

Here’s why — and what you can do.

The Role of Firewalls

Firewalls are often referred to as the first line of defense for your network. Now, here’s the thing—that firewall is only as good as the config that is running on it. It’s not as simple as slapping on a device and taking it off.

You can think of firewalls like the brakes and steering on a car. Without proper reins at the top, you’re just inviting disaster. A firewall:

• Controls traffic in and out
• Blocks unwanted connections
• Segments your network to minimize damage in the event of a breach
• Enforces security policies

If any of these controls is loose or wrong, you’ve given hackers the keys.

In the days of the PSTN, protocols were simpler — with a handful of entry points they needed to manage, it was less risky in that sense. Today it’s nuts the complexity. That means applications, cloud services, IoT devices — you name it, and firewalls must keep pace.

But rules that are poorly set, totally forgotten or simply based on assumptions that are no longer true? That’s the problem.

Common Breach Scenarios

There’s not a single company I can’t walk into and find obvious firewall mistakes that shouldn’t exist anymore in 2024. Here are some examples that still occur way too frequently:

• Ports should be opened for only essential services. We want to give attackers a free pass? No big deal, just leave that RDP or SMB port open to the world on your external interface. It’s like leaving your car in a shady part of town with the engine running.
• Overly permissive rules. That allow all setting? At this point, you are not taking a security posture, you are just waiting for the inevitable. Even worse, some admins just leave ancient rules active “just in case”—and those legacy open doors get exploited all the time.
• Hoping the segmented networks will be ignored. A flat network just for the sake of convenience costs you lateral movement once an intruder is in. Proper segmentation should be enforced by firewalls. Failing to do so makes your entire network one large playground for attackers.
• Management Interfaces of Firewalls with Default Credentials or Weak Credentials I know this sounds like a rookie mistake but you wouldn’t believe how often I find this in the wild. If the better admin:admin? If your firewall device itself can be accessed by eight, great.

It reminds me of helping out a bank which had a firewall rule that opened up inbound traffic from an entire country, because they assumed “It would never get exploited”. Spoiler alert: It did, and the breach was costly — millions, in fact.

Rule-Based Mistakes

Firewall security rules are the DNA of the firewall. And ill-formed DNA results in a sick network.

Here’s where admins (me previously included) stumble:

• Preaching rules with out of context. All rules should be intentional and written down. Reapplying sample configs or blindly importing policies from other organizations leaves gaping holes.
• Rules that are overly broad or ambiguous. Don’t be too permissive: Allow all traffic to this with this server rather than limiting to only the necessary ports or protocols, for example. It’s like giving a thief a skeleton key rather than a proper lock.
• Not getting rid of old rules. Firewalls are so similar but so different. Legacy rules remain and turn into backdoors for attackers to abuse.
• Avoiding the deny by default model. Default allow all except denied services? That’s backward and dangerous.

I’m going to be frank with you—I’ve done this. I was, early on, guilty of overwriting rules, then I was guilty of overwriting rules and then I was guilty of oversimplifying rules — [these] were all damaging equally. So in time I learned my lesson about keeping your rule set short, tight, and well-reviewed.

Lack of Monitoring

What you did not expect is a rant — if you are not taking a look at the firewall logs and alerts, you are flying blind.

Would you drive a car with no dashboard indicating speed, fuel or warning lights? Yet, many organizations:

• Frequency of Reviewing Firewall Logs
  Have so much alert fatigue, that you ignore alerts
• Conduct monthly or quarterly audits rather than real-time tracking

That’s a recipe for disaster.

When PJ Networks conducts firewall audits, we always discover:

• Unexplained surges in denied traffic that precede breaches
• All are rules that never got invoked, but still harbor dangers
• Alerts from monitoring tools that do not detect important events

Pro tip: Find a way to automate the log analysis but automate people not reading the logs.

If you’re saying, But that’s too much work, I hear you. But security isn’t set and forget. It’s a worldly defense — your castle needs sentinels, not just palls.

Best Practices

So how does someone avoid these traps? I’m not going to bore you with UNSOLICITED advice. Instead, here’s what I’ve learned (and implemented in those recent zero-trust bank overhauls) that actually results in change:

• Never allow incoming and outgoing traffic by default unless to explicitly allowed. No exceptions.
• Audit your firewall rules on a regular basis at least quarterly if not monthly. Find unused or old rules to cut.
• Implement appropriate network segmentation, specifically between sensitive holding environments and general user environments.
• Immediately change default credentials, and enable MFA where applicable for access to firewall management
• Use automation for threat detection, but always have a human in the loop for context.
• Keep records of every rule change why you made them and the dates you reviewed them. Accountability matters.
• Most importantly, train your teams on firewall management every now and then (a workshop every 6 months min.
• Don’t trust AI-powered solutions blindly — sure they can be helpful but they aren’t cure-alls. Firewalls need to be configured by humans that know the context.

Quick Take

For those skimming this:

• Misconfigured firewalls is still a leading cause of breaches
• Things we found wrong: open ports, open access rules, no segmentation
• There is no two ways about regular audit and monitoring
• Policy of deny by default always
• Use tools wisely rather than blindly

Conclusion

Here’s the bottom line: A firewall is more than a box you install and ignore. It’s less like a rocket ship, and more like a classic car, you gotta tune it, you gotta maintain it, you gotta pop the hood from time to time. Otherwise, it breaks down. And when it does, it’s not merely inconvenient — it’s a full-bore breach, lost data and maybe a shredded reputation.

And yeah — I’ve learned that the hard way as well. A lot of late evenings cleaning up the mess left by a single improperly written firewall rule.

Our mission at PJ Networks is to prevent those mistakes for businesses. As the saying goes, cyber defense isn’t only about technology, it’s about mindful configuration and ongoing vigilance.

Stay safe out there. And, before you call your firewall set, take a second look. It could save you millions, just that.

—Sanjay Seth
Founder & Cybersecurity Consultant at P J Networks Pvt Ltd