Firewalls

The firewall control makes sure only secure and necessary network services can be reached from the internet. Requirements v3.3 says every device in scope must be protected by a correctly configured firewall, or a network device with firewall functions. That can be a boundary firewall on a network you control, the software firewall on the device itself, or both.

What the control applies to

Version 3.3 applies this control to boundary firewalls, desktop computers, laptops, routers, servers, and IaaS, PaaS and SaaS cloud services. Phones and tablets are not on that list.

Boundary firewall or software firewall

A boundary firewall is a network device that filters traffic in and out of your network using rules based on where traffic comes from, where it is going and what protocol it uses. In a small office this is usually the firewall built into the router.

A software firewall runs on a single device and protects only that device, wherever it is used. Version 3.3 says that if you do not control the network a device connects to, such as a home broadband connection or public wifi, you must configure a software firewall on the device. It also advises using the firewall that comes with the operating system, such as Windows Defender Firewall or the macOS firewall, rather than adding a third-party one.

Many organisations use both: the office router for desks on site, and the device firewall for laptops that travel. If you have no office at all, the software firewall on each laptop and desktop is the whole control.

In the cloud, firewall rules are usually called security groups, network access control lists or data flow policies. For virtual servers you configure these yourself. For SaaS the provider normally handles it. See the cloud shared responsibility model.

The requirements, in plain English

For every firewall, v3.3 says you must:

1. Replace the default admin password. Set a strong, unique password that meets the password rules, or turn off remote administration entirely.
2. Keep the admin interface off the internet. The page used to manage the firewall must not be reachable from the internet unless there is a clear, documented business need. If it is, it must be protected by MFA, or by an allow list limited to a small range of trusted IP addresses together with a properly managed password.
3. Block unauthenticated inbound connections by default. Nothing from the internet should get in unless a rule allows it.
4. Approve and document inbound rules. Each rule that lets traffic in must be approved by an authorised person, with the business need written down.
5. Remove rules you no longer need. Old port forwards and test rules must be removed or disabled.

For software firewalls, the admin password requirement is met by controlling who has administrator rights on the device, so users cannot simply turn the firewall off.

Common problems

• The firewall is switched off on a few laptops because an application once needed it.
• A port forward for an old CCTV system, remote desktop or a former IT provider is still open.
• The router's admin page is reachable from the internet with the password printed on its label.
• No one can say who approved an inbound rule, or why.
• Cloud virtual servers allow inbound traffic from anywhere on management ports.

What to do

1. List every boundary firewall and router you control, and every laptop, desktop and server.
2. Turn on the software firewall on each computer, and enforce it centrally with Intune, group policy or your MDM if you can.
3. Log in to each router or firewall and change the default admin password. Turn off remote administration unless you need it.
4. Export or write down the inbound rules. Remove anything unneeded and record the approver and reason for the rest.
5. For cloud servers, set security groups to deny inbound traffic by default and open only the ports you need.

See also routers and network devices and home and remote workers. The readiness checker walks through these questions for your setup.