Inbound exceptions to the firewall on domain workstations must only allow authorized remote management hosts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36440	WN08-FW-000100	SV-48370r2_rule	ECSC-1	Medium

Description
Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote management systems will help limit this exposure.

STIG	Date
Windows 8/8.1 Security Technical Implementation Guide	2017-02-27

Details

Check Text ( C-45039r1_chk )
Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts. If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding. Review inbound firewall exceptions. Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Inbound Rules (this link will be in the right pane) -> For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles. If a third-party firewall is used, ensure comparable settings are in place.

Check Text ( C-45039r1_chk )

Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts.

If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding.

Review inbound firewall exceptions.
Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Inbound Rules (this link will be in the right pane) ->

For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles.

If a third-party firewall is used, ensure comparable settings are in place.

Fix Text (F-41501r1_fix)
Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts. Configure only inbound connection exceptions for authorized remote management hosts. Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Inbound Rules (this link will be in the right pane) -> For any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles. If a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.

Fix Text (F-41501r1_fix)

Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts.

Configure only inbound connection exceptions for authorized remote management hosts.
Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Inbound Rules (this link will be in the right pane) ->

For any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles.

If a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.