The firewall implementation must enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000018-FW-000017	SRG-NET-000018-FW-000017	SRG-NET-000018-FW-000017_rule		Medium

Description
If the firewall implementation is not configured to control the flow of information within the network based on organization-defined information flow control policies, malicious or otherwise unauthorized access can occur. Controlling the flow of network traffic within a network is as important as controlling the flow of network traffic between networks and is part of the practice of defense-in-depth. A firewall is a network security tool, implemented either as software or in hardware, which controls the flow of incoming and outgoing network traffic by analyzing the data packets and determining whether they should be allowed through or not, based on an applied rule set. This rule set or Access Control List (ACL) is an ordered list of rules that defines access control policies and allows or denies access to information system resources such as applications, services, or devices.

Description

If the firewall implementation is not configured to control the flow of information within the network based on organization-defined information flow control policies, malicious or otherwise unauthorized access can occur. Controlling the flow of network traffic within a network is as important as controlling the flow of network traffic between networks and is part of the practice of defense-in-depth. A firewall is a network security tool, implemented either as software or in hardware, which controls the flow of incoming and outgoing network traffic by analyzing the data packets and determining whether they should be allowed through or not, based on an applied rule set. This rule set or Access Control List (ACL) is an ordered list of rules that defines access control policies and allows or denies access to information system resources such as applications, services, or devices.

STIG	Date
Firewall Security Requirements Guide	2014-07-07

Details

Check Text ( C-SRG-NET-000018-FW-000017_chk )
Review the configuration of the firewall implementation to verify access to information and system resources is restricted based on a properly configured Access Control List or rule set. If the firewall implementation is not configured to enforce approved authorizations for logical access to information and system resources, this is a finding.

Fix Text (F-SRG-NET-000018-FW-000017_fix)
Configure the firewall/ACL to control the flow of information within the network based on organization-defined information flow control policies.