Implement and Manage a Firewall on End>User Devices
Description
Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.
Implementation Checklist
Tool Recommendations
Automated CIS Benchmark assessment tool for configuration compliance scanning across OS, applications, and cloud
Center for Internet Security · CIS SecureSuite membership
Cloud-based configuration assessment and compliance platform with CIS Benchmark support and continuous monitoring
Qualys · Per-asset subscription
Security configuration management and file integrity monitoring platform with policy compliance and drift detection
Fortra (Tripwire) · Per-node subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Direct Endpoint Exploitation from Network
ConfidentialityAttackers exploit services running on end-user devices (RDP, SMB, WinRM) that are accessible because no host-based firewall blocks inbound connections from unauthorized sources.
Peer-to-Peer Malware Spread Between Workstations
AvailabilityMalware on one workstation spreads directly to other workstations via network shares and services because no endpoint firewall restricts workstation-to-workstation traffic.
Vulnerabilities (When Safeguard Absent)
No Default-Deny Firewall on End-User Devices
Without a host-based firewall with a default-deny inbound rule, end-user devices accept connections on all ports, exposing every running service to the network.
Unrestricted Outbound Communication from Endpoints
Without firewall port filtering on endpoints, malware can establish outbound connections to command-and-control servers on any port or protocol.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Firewall rule set export and review documentation | Reviewed quarterly |
| Record | Firewall change request and approval records | Per change |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |