Check: WNFWA-000100
Microsoft Windows Defender Firewall with Advanced Security STIG:
WNFWA-000100
(in version v2 r2)
Title
Inbound exceptions to the firewall on domain workstations must only allow authorized remote management hosts. (Cat II impact)
Discussion
Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote management systems will help limit this exposure.
Check Content
This requirement is NA for servers and non domain workstations. Verify firewall exceptions for inbound connections on domain workstations only allow authorized management systems and remote management hosts. Review inbound firewall exception rules in Microsoft Defender Firewall with Advanced Security. Firewall rules can be complex and should be reviewed with the firewall administrator. One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses. If allowed inbound exceptions are not limited to authorized management systems and remote management hosts, this is a finding.
Fix Text
Ensure firewall exceptions to inbound connections on domain workstations only allow authorized management systems and remote management hosts. Firewall rules can be complex and should be thoroughly tested before applying in a production environment. One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses. For any inbound rules that allow connections from other systems, configure the Scope for Remote IP addresses to those of authorized management systems and remote management hosts. This may be defined as an IP address, subnet, or range. Apply the rule to all firewall profiles.
Additional Identifiers
Rule ID: SV-242009r922967_rule
Vulnerability ID: V-242009
Group Title: SRG-OS-000480-GPOS-00227
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000067 |
The information system monitors remote access methods. |
Controls
Number | Title |
---|---|
AC-17 (1) |
Automated Monitoring / Control |