Administrative access to respond to requests to change the firewall is limited to one individual at a time

Active network connections are tracked so that invalid response' traffic can be identified.

A current baseline of application configurations is maintained and any mis-configuration is responded to promptly

Logs of user activity on the firewall are correlated to identify and respond to suspicious behavior