Detections
Analytics

9.1.2 Ensure 'Windows Firewall: Domain: Inbound connections' is set to 'Block (default)'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines the behavior for inbound connections that do not match an inbound firewall rule.

The recommended state for this setting is: Block (default).

If the firewall allows all traffic to access the system, then a threat actor may be able to remotely exploit a weakness in a network service.

Solution

To establish the recommended configuration via GP, set the following UI path to Block (default) :

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Defender Firewall Properties\Domain Profile\Inbound connections

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/25733

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4, CSCv7|11.2

Plugin: Windows

Control ID: 47b53bad72905913cd5ce0c0ac414a63bf2987e59b25fd09fa53549a7a22656a