{"id":"sec-it-firewall-rule-review","audience":"it-security","category":"security","track":"security","technique":"constraints","title":"Find the firewall rules that break your policy","free":false,"task":"Review this firewall export against your policy: no 'any to any' allow rules; no SSH (22) or RDP (3389) allowed from 'any' source; every allow rule has an owner; allow rules past their expiry date get removed (today is Nov 6, 2026). HTTPS from any source to the web server is approved. List only the rules that break the policy, numbered, each with the rule ID, the policy it breaks, and the fix. Plain text, under 80 words.","materialLabel":"Firewall export from edge-fw-01 (attached to your prompt automatically)","material":"edge-fw-01 rule export, Nov 6, 2026\n\nid  | source           | destination              | port | action | owner     | expires    | comment\n100 | any              | 192.0.2.10 (web-01)      | 443  | allow  | Web team  | none       | public website\n110 | 198.51.100.0/24  | 192.0.2.20 (bastion-01)  | 22   | allow  | Infra     | none       | office VPN range to jump host\n120 | any              | 192.0.2.30 (support-01)  | 3389 | allow  |           | none       | temp for vendor support, Jun 2025\n130 | any              | any                      | any  | allow  | Infra     | 2026-12-31 | troubleshooting, remove later\n140 | 203.0.113.0/24   | 192.0.2.40 (sftp-01)     | 22   | allow  | Finance   | 2026-08-31 | partner bank file drop\n150 | any              | any                      | any  | deny   | Infra     | none       | default deny\n\nNotes from the last review (May 2026):\n- 198.51.100.0/24 is our office VPN address range.\n- The partner bank moved to a new file transfer service in September.\n- Rule 130 was added during a network outage in March.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":80}],"mistakes":[{"title":"Not giving the policy","why":"The AI flags anything that looks risky, like SSH to the jump host from your own VPN range.","fix":"Paste the rules: \"No any-to-any, no SSH or RDP from any, owners required, expired rules removed.\"","checks":["r0"]},{"title":"Forgetting today's date","why":"Without the date, the AI can't tell that rule 140 has expired.","fix":"Add: \"Today is Nov 6, 2026.\"","checks":["r1"]},{"title":"Reviewing every rule","why":"The AI writes a line for all 6 rules, including the fine ones.","fix":"Say: \"List only rules that break the policy.\"","checks":["numberedItems"]},{"title":"Vague fixes","why":"The AI says 'review this rule' instead of what to change.","fix":"Ask: \"Give the fix: remove, or restrict the source.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 80 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 60 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the change request they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the policy","patterns":["any to any","any-to-any","3389","rdp","owner"]},{"label":"Gives today's date","patterns":["today","nov(ember)? 6","2026-11-06","expir"]},{"label":"Lists only violations","patterns":["only (the )?rules","break","violat","fail"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Your policy decides what counts as a violation, not the AI's sense of risk. Give it the rules, today's date and the approved exception, and ask only for what breaks.","rubricLabels":["Lists exactly rules 120, 130 and 140, and does not list 100, 110 or 150","Rule 120 is flagged for RDP from any source (and no owner), rule 130 for any-to-any allow, and rule 140 for being past its 2026-08-31 expiry","Each line gives a concrete fix (for example remove the rule, or restrict the source and add an owner)"]}