3.3 Ensure firewall policy denying all traffic to/from Tor, malicious server, or scanner IP addresses using ISDB

Information

Firewall policies should include a deny rule for traffic going to/from Tor, malicious server, or scanner IP addresses using ISDB (Internet Service Database).

FortiGate includes Tor or malicious server related IP address using ISDB. The idea is to filter out malicious traffic using firewall policies as first level filtering. This is done without involving more resource intensive processes such as IPS inspection, hence optimizing FortiGate's performance.

Solution

Review firewall policies and ensure there are:

- A firewall policy created to block inbound connections with these settings:

From: Any
To: Any
Source: "Tor-Exit.Node", "Tor-Relay.Node", "Censys-Scanner", "Shodan-Scanner", "Botnet-C&C.Server", "Phishing-Phishing.Server", "Proxy-Proxy.Server", "Spam-Spamming.Server", "VPN-Anonymous.VPN", and "Malicious-Malicious.Server"
Destination: all
Schedule: Always
Services: All
Action: Deny
Log Violation Traffic: Enabled
Enable this policy: Enabled <xhtml:ol start="2"> - A firewall policy created to block outbound connections with these settings:

From: Any
To: Any
Source: All
Destination: "Tor-Relay.Node", "Botnet-C&amp;amp;C.Server", "Phishing-Phishing.Server", "Proxy-Proxy.Server", "Spam-Spamming.Server", "VPN-Anonymous.VPN", and "Malicious-Malicious.Server"
Schedule: Always
Action: Deny
Log Violation Traffic: Enabled
Enable this policy: Enabled

See Also

https://workbench.cisecurity.org/benchmarks/15284

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-18, 800-53|AC-18(1), 800-53|AC-18(3), 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|CP-6, 800-53|CP-7, 800-53|PL-8, 800-53|PM-7, 800-53|SA-8, 800-53|SC-7, CSCv7|12.2, CSCv7|12.3, CSCv7|13.3

Plugin: FortiGate

Control ID: 351352b824aceff39a3efe6737b9b2179f3d4f9f28b9b405083e1375c1266cd5