The dead configuration policies in production network is a major challenge for most IT networking group and security groups. 

Companies spend millions of dollars on network security to make sure malicious user or DDoS attacks on company’s resources & data. However, what they fail to address is, there is a big security risk with people who were granted access earlier due to valid business reasons but their access is not revoked once business engagement is terminated. 

For example, “Partner Connectivity with Enterprise Network”. 

A medium to large size enterprise/financial institution works with various partners (solution partner, product partner, implementation partner, sales/marketing partners etc.). In order for these partners to work seamlessly with enterprise/financial businesses, partners users are given secured access to enterprise network. Typically, this process requires adding/changing network ACLs across enterprise network, apart from other steps.

Do you see dead-network-acls in your network? How do you know what ACLs are applied for what purpose? How to clean ACLs once partner contract is terminated?