The firewall must fail closed if the firewall filtering function is nonfunctional.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79411	SRG-NET-000235-FW-000160	SV-94117r1_rule		Medium

Description
While failure to an open state may ensure users are not inconvenienced, it also circumvents a critical security network function that guards against direct and indirect network attacks. Allow traffic to flow without filtering or inspection puts the entire network and DoD critical assets at immediate risk. An example is a network element that blocks all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic). This prevents an attacker from forcing a failure of the system in order to obtain access.

Description

While failure to an open state may ensure users are not inconvenienced, it also circumvents a critical security network function that guards against direct and indirect network attacks. Allow traffic to flow without filtering or inspection puts the entire network and DoD critical assets at immediate risk. An example is a network element that blocks all traffic rather than allowing all traffic when a network element component fails (e.g., fail closed and do not forward traffic). This prevents an attacker from forcing a failure of the system in order to obtain access.

STIG	Date
Firewall Security Requirements Guide	2018-12-24

Details

Check Text ( None )
None

Fix Text (None)
None