| Unauthorized traffic is untrusted traffic and may be malicious. Traffic originating from unauthorized sources may be hostile and pose a threat to an enclave or to other connected networks. Traffic originating from authorized sources but connecting to unauthorized destinations may be the result of compromised external hosts. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Therefore, all expected traffic must be identified by application, endpoints, protocol, and port and then vetted. Only those connections (or traffic flows) which are essential and approved must be allowed.
The firewall or other device implementing an Access Control List must only allow traffic from authorized sources to authorized destinations. Sources and destinations should be as specifically identified as possible. All other inbound and outbound traffic must be denied by default. |
