STIGQter: STIG Summary: Windows Firewall with Advanced Security Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 27 Apr 2018:

Inbound exceptions to the firewall on domain workstations must only allow authorized remote management hosts.

DISA Rule

SV-55086r1_rule

Vulnerability Number

V-36440

Group Title

Inbound Firewall Exception for Administration

Rule Version

WNFWA-000100

Severity

CAT II

CCI(s)

• CCI-000067 - The information system monitors remote access methods.

Weight

10

Fix Recommendation

Ensure firewall exceptions to inbound connections on domain workstations only allow authorized management systems and remote management hosts.

Firewall rules can be complex and should be thoroughly tested before applying in a production environment.

One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses. For any inbound rules that allow connections from other systems, configure the Scope for Remote IP addresses to those of authorized management systems and remote management hosts. This may be defined as an IP address, subnet, or range. Apply the rule to all firewall profiles.

Check Contents

This requirement is NA for servers and non domain workstations.

Verify firewall exceptions for inbound connections on domain workstations only allow authorized management systems and remote management hosts.

Review inbound firewall exception rules in Windows Firewall with Advanced Security. Firewall rules can be complex and should be reviewed with the firewall administrator.

One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses.

If allowed inbound exceptions are not limited to authorized management systems and remote management hosts, this is a finding.

Vulnerability Number

V-36440

Documentable

False

Rule Version

WNFWA-000100

Severity Override Guidance

This requirement is NA for servers and non domain workstations.

Verify firewall exceptions for inbound connections on domain workstations only allow authorized management systems and remote management hosts.

Review inbound firewall exception rules in Windows Firewall with Advanced Security. Firewall rules can be complex and should be reviewed with the firewall administrator.

One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses.

If allowed inbound exceptions are not limited to authorized management systems and remote management hosts, this is a finding.

Check Content Reference

M

Target Key

2565

Comments