Details
Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote management systems will help limit this exposure.
Solution
Ensure firewall exceptions to inbound connections on domain workstations only allow authorized management systems and remote management hosts.
Firewall rules can be complex and should be thoroughly tested before applying in a production environment.
One method for restricting inbound connections is to only allow exceptions for a specific scope of remote IP addresses. For any inbound rules that allow connections from other systems, configure the Scope for Remote IP addresses to those of authorized management systems and remote management hosts. This may be defined as an IP address, subnet, or range. Apply the rule to all firewall profiles.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Windows.
References
- 800-53|AC-17(1)
- CAT|II
- CCI|CCI-000067
- Rule-ID|SV-242009r698268_rule
- STIG-ID|WNFWA-000100
- STIG-Legacy|SV-55086
- STIG-Legacy|V-36440
- Vuln-ID|V-242009