[Autogenerated] So if we look at this requirement
requirement 1.11 point two on 1.3.
What are the typical barriers for an organization you know,
succeeding with this requirement?
The most typical problems I found for very large organizations that
have either grown by acquisition or just deployed a lot of network
devices and put a lot of rules in is that it's very difficult to get a
handle on those rules justifications.
Right?
You go and you talk to the firewall team and they say,
I don't really know what purpose this rule serves.
I get a change ticket that's been authorized by a VP.
Uh,
and then I go when I put the rule in the config and I don't know what it does,
right?
And you going, you talkto the server teams,
you have the devices and they say, You know,
we just put in rules for what we need right at the time,
and then we don't think about them anymore,
right?
And so they don't really know when the application
people don't necessarily really know.
In the business, owners don't really know,
and you have this sort of diffuse kind of knowledge problem where nobody
can put all the pieces together and then to go say,
go justify while these rules are here,
these sometimes tens of thousands of rules spread
across maybe hundreds of devices, uh,
can be a real challenge to get a handle on if you've let that
right over grow for a long period of time.
So it sounds to me like the best thing is in your change management process.
The change doesn't happen unless the field where it says
what is the business rule for this change is filled out
right and tow have that meaningful?
Lee described right,
right in such a way that you can then grab all of those fields right,
put them in a spreadsheet or some similar sort of thing along with the rules,
and then present that to somebody whose job it is to go review them,
who can then go say to the business owners to all the relevant people.
Do you still need this function right?
And then do the particulars of this rule the ports,
the source I p is the destination I P's still apply.
Okay, right.
And then if the rule is no longer necessary then you can print it out.
Right?
And if it's just that Oh,
now we have Maur fewer or different I p addresses on one side
of this or the other than you can amend it.
Uh, and if you can do that,
then you have a reasonable handle on this sort of thing.
And that's that the, I think, the biggest challenge for large,
complex organizations.
So you'd agree putting the business requirements,
the change to get Sounds like a good idea.
I think that's generally a good idea, yes.