9.1.2 Ensure 'Windows Firewall: Domain: Inbound connections' is set to 'Block (default)'

Information

This setting determines the behavior for inbound connections that do not match an inbound firewall rule.

The recommended state for this setting is: Block (default).

Rationale:

If the firewall allows all traffic to access the system then an attacker may be more easily able to remotely exploit a weakness in a network service.

Impact:

None - this is the default behavior.

Solution

To establish the recommended configuration via GP, set the following UI path to Block (default):

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Inbound connections


Default Value:

Block (default). (The Windows Firewall with Advanced Security will block all inbound connections that do not match an inbound firewall rule in this profile.)

Additional Information:

Windows Firewall with Advanced Security Technical Implementation Guide:
Version 1, Release 7, Benchmark Date: April 27, 2018

Vul ID: V-17418
Rule ID: SV-54859r3_rule
STIG ID: WNFWA-000004
Severity: CAT I

See Also

https://workbench.cisecurity.org/files/3476

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4, CSCv7|11.2

Plugin: Windows

Control ID: 498c2f7acd14bea392d9974896e1e1ac66f6375cc10cf3b843a573030cabb42f