9.3.2 Ensure 'Windows Firewall: Public: Inbound connections' is set to 'Block (default)'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This setting determines the behavior for inbound connections that do not match an inbound firewall rule.

The recommended state for this setting is: Block (default).

Rationale:

If the firewall allows all traffic to access the system then an attacker may be more easily able to remotely exploit a weakness in a network service.

Impact:

None - this is the default behavior.

Solution

To establish the recommended configuration via GP, set the following UI path to Block (default):

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Inbound connections


Default Value:

Block (default). (The Windows Firewall with Advanced Security will block all inbound connections that do not match an inbound firewall rule in this profile.)

Additional Information:

Windows Firewall with Advanced Security Technical Implementation Guide:
Version 1, Release 7, Benchmark Date: April 27, 2018

Vul ID: V-17438
Rule ID: SV-54906r3_rule
STIG ID: WNFWA-000020
Severity: CAT I

See Also

https://workbench.cisecurity.org/files/3345