STIGQter: STIG Summary: Microsoft Windows Defender Firewall with Advanced Security Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 09 Nov 2023:

Inbound exceptions to the firewall on domain workstations must only allow authorized remote management hosts.

DISA Rule

SV-242009r922967_rule

Vulnerability Number

V-242009

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

WNFWA-000100

Severity

CAT II

CCI(s)

• CCI-000067 - Employ automated mechanisms to monitor remote access methods.

Weight

10

Fix Recommendation

Ensure firewall exceptions to inbound connections on domain workstations only allow authorized management systems and remote management hosts.

Firewall rules can be complex and should be thoroughly tested before applying in a production environment.

One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses. For any inbound rules that allow connections from other systems, configure the Scope for Remote IP addresses to those of authorized management systems and remote management hosts. This may be defined as an IP address, subnet, or range. Apply the rule to all firewall profiles.

Check Contents

This requirement is NA for servers and non domain workstations.

Verify firewall exceptions for inbound connections on domain workstations only allow authorized management systems and remote management hosts.

Review inbound firewall exception rules in Microsoft Defender Firewall with Advanced Security. Firewall rules can be complex and should be reviewed with the firewall administrator.

One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses.

If allowed inbound exceptions are not limited to authorized management systems and remote management hosts, this is a finding.

Vulnerability Number

V-242009

Documentable

False

Rule Version

WNFWA-000100

Severity Override Guidance

This requirement is NA for servers and non domain workstations.

Verify firewall exceptions for inbound connections on domain workstations only allow authorized management systems and remote management hosts.

Review inbound firewall exception rules in Microsoft Defender Firewall with Advanced Security. Firewall rules can be complex and should be reviewed with the firewall administrator.

One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses.

If allowed inbound exceptions are not limited to authorized management systems and remote management hosts, this is a finding.

Check Content Reference

M

Target Key

5363