The firewall implementation must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000015-FW-000015	SRG-NET-000015-FW-000015	SRG-NET-000015-FW-000015_rule		Medium

Description
If the firewall implementation is not configured to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies, malicious or otherwise unauthorized access can occur. A firewall is a network security tool, implemented either as software or in hardware, which controls the flow of incoming and outgoing network traffic by analyzing the data packets and determining whether they should be allowed through or not, based on an applied rule set. This rule set or Access Control List (ACL) is an ordered list of rules that defines access control policies and allows or denies access to information system resources such as applications, services, or devices.

Description

If the firewall implementation is not configured to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies, malicious or otherwise unauthorized access can occur. A firewall is a network security tool, implemented either as software or in hardware, which controls the flow of incoming and outgoing network traffic by analyzing the data packets and determining whether they should be allowed through or not, based on an applied rule set. This rule set or Access Control List (ACL) is an ordered list of rules that defines access control policies and allows or denies access to information system resources such as applications, services, or devices.

STIG	Date
Firewall Security Requirements Guide	2014-07-07

Details

Check Text ( C-SRG-NET-000015-FW-000015_chk )
Verify access to information and system resources is restricted based on a properly configured Access Control List or rule set. If the firewall implementation is not configured to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies, this is a finding.

Fix Text (F-SRG-NET-000015-FW-000015_fix)
Configure the firewall implementation to enforce logical access to information and system resources in accordance with the access control policies.