Best Practices for Ongoing Maintenance in ASMS

Managing network devices is a critical component of ensuring accurate network modeling and risk analysis within the AlgoSec Security Management Suite (ASMS). As your network environment evolves, devices are added, updated, and decommissioned, all of which must be accurately reflected in ASMS to maintain security posture and network visibility. Key processes, such as adding new devices, updating credentials, and integrating unsupported devices, require careful attention to ensure the ASMS topology remains up-to-date and effective.

This guide will explore best practices for maintaining device configurations, automating routine tasks, and utilizing tools to address network gaps. By following these guidelines, you can streamline device management and enhance the accuracy of your network model.

Algosec Firewall Analyzer

Task (click to expand for more information) Frequency Automation Possible?

As new network devices are introduced into your environment, they must be added to ASMS.

Unmanaged devices can be added individually or imported in bulk. For managed devices, you need to add the manager device in ASMS, which will automatically pull in the managed devices.

 Weekly Yes

When network devices are decommissioned, they should be removed from ASMS to keep the map modeling accurate and free of outdated information.

 Weekly Yes

If you are using standard or custom risk profiles based on security zones, it's necessary to update the topology of newly added or modified devices to ensure accurate risk analysis.

Automation Options:

  1. Partial automation is possible as a custom process via API. Dependent on provided inventory source or specified logic. Use the following APIs:

  2. Full automation is possible with assistance of AlgoSec Professional Services.

 On Addition Yes

If ConnectStubs is implemented in your environment, ensure the configuration file is updated as needed. ConnectStubs is used solely to address specific gaps in the network that cannot be modeled by ASMS.

  1. Such situations were identified during the initial configuration and any changes to the gap areas would require an update to the ConnectStubs configuration.

  2. For example, if ConnectStubs was used to represent MPLS networks, then any changes such as new connections, removed connections, or modified connections to the MPLS networks would require an update to the ConnectStubs configuration

AlgoSec Professional Services will provide the necessary documentation if ConnectStubs is implemented in your environment.

Automation can be achieved by using scripts to update the required configuration files.

 Situational Yes

Layer 2 devices require manual URT creation for accurate analysis. If you have a large number of Layer 2 devices, a semi-automated solution for generating these URTs can be implemented with assistance from AlgoSec Professional Services.

For details on configuring Layer 2 Devices, see Manage layer 2 devices in the map, Specify routing data manually.

Automation is possible by using scripts to place the devices into subnets and generate the URT files. For assistance with this, contact AlgoSec Professional Services.

 Situational Yes

Devices that are unsupported by AlgoSec or have specific unsupported configurations may require manual URT creation to accurately represent them on the map and ensure precise map modeling..

For details on configuring Manual URTs, see Specify routing data manually

Automation is possible via custom scripts that collect the routes and interfaces from the device and convert to the URT file format.

 Situational Yes

The Topology Advisor helps identify missing routers or other devices and can be used to detect gaps in the network or recognize newly added devices.

 Monthly Partial

The credentials used to connect to the network devices must be updated when they are updated in your environment.

 Situational Partial

If LDAP authentication is configured, a bind account is typically used. When the password for this account is updated, it must also be updated in ASMS.

 Situational No

When new users need privileged access to Firewall Analyzer, FireFlow, or AppViz, they must be added as privileged users in Firewall Analyzer.

 Situational Yes

Environment Health

Task (click to expand for more information) Frequency Automation Possible?

The service status should be checked to ensure the system is operating as expected.

  • For details on checking the status of system services, see Test ASMS processes.

  • Information on critical services is alerted on via the AlgoSec Watchdog process. These messages can be forwarded to an external system for automated alerting. See ASMS Monitoring and syslog messages.

 Daily Yes

Disk space and memory usage should be monitored to prevent resource exhaustion and ensure optimal system performance.

  • Disk space and memory usage can be checked by using standard Linux utilities df, du and free.

  • Information on disk space or memory thresholds is alerted on via the Algosec Watchdog process. These messages can be forwarded to an external system for automated alerting. See ASMS Monitoring and syslog messages.

 Daily Yes

If HA or DR are used, the status of synchronization between nodes should be checked on a regular basis to ensure that the system is available.

 Daily Yes

When the Distributed Architecture is used the system should be checked on a regular basis to ensure that the distributed nodes and communicating and functioning correctly

  • Check for a “green” status on the Distributed Architecture page. For details on the Distributed Architecture configuration, see Configure a distributed architecture.

  • Information on Load-Distribution or Geo Distribution connection events is alerted via the AlgoSec Watchdog process. These messages can be forwarded to an external system for automated alerting. See ASMS Monitoring and syslog messages.

 Daily Yes

When hotfixes are released, review the release notes to identify any fixes relevant to your specific ASMS environment.

  • For details on upgrade the ASMS system, see Upgrade your system.

  • Automation is not currently possible for this task.

 Monthly No

Major Version Upgrade

 Bi-Yearly No

AppViz

Task (click to expand for more information) Frequency Automation Possible?

Privileged users should first be added to Firewall Analyzer. Afterward, their roles and permissions for AppViz can be updated accordingly.

 Situational Yes

When new applications need to be added, the Application Discovery process can be utilized to import them.

 Situational No

FireFlow

Task (click to expand for more information) Frequency Automation Possible?

Privileged users should first be added to Firewall Analyzer. Afterward, their roles and permissions for FireFlow can be updated as needed.

  • For details on managing Privileged users in FireFlow, see Manage privileged users.

  • Automation is not currently possible for this task.

 Situational No

FireFlow will attempt to automatically match change requests with the detected changes on devices. However, this may not occur if the matching is unsuccessful or if the workflow doesn't support auto-matching.

  • For details on resolving unmatched changes, see Resolve unmatched changes.

  • Automation is not currently possible for this task.

 Weekly No