AuditUnit 4 · Topic 4.3
Host-based firewall: which rules should change?
Review a laptop firewall and decide which rules should change.
New to this? Read the topic first: 4.3 Protecting Devices.
Simulation · [4.3.D.1, 4.3.D.2, 4.3.D.3, 4.3.D.4]
Host-based firewall: which rules should change?
This laptop at 10.0.8.15 is used only for browsing, web-based email and the school's learning platform, all over HTTPS. Rules are checked in order, first match wins. HTTPS (hypertext transfer protocol secure) is secure web traffic, DNS (domain name system) looks up website names, RDP (remote desktop protocol) is remote desktop, SSH (secure shell) is secure remote login and Telnet is unencrypted remote login. TCP is the transmission control protocol and UDP the user datagram protocol. Tap every rule that allows something the device does not need, or that makes a later rule useless. There are 3.
-
Fine. Secure web traffic out is exactly what this laptop needs.
-
Fine. Looking up website names is needed for browsing.
-
Red flag. Remote desktop open to anyone: an open port the laptop does not need. Block it.
-
Red flag. Allows every inbound connection, so the Telnet deny below is never reached. Host firewalls should block what is not needed.
-
Fine. Blocking Telnet is right, but rule 4 matches first, so this rule never runs until rule 4 is removed.
-
Red flag. Outbound remote login to any server is not needed for browsing and email. Block services the device does not use.
-
Fine. A default deny for inbound traffic at the end is good practice.
-
Fine. A default deny for outbound traffic means anything not allowed above, such as file transfers to unknown servers, is blocked.
Go to the topic: 4.3 Protecting Devices