Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen have centered on locally defined firewall rules or had dozens of group policies.

I have been thinking it would make sense to extrapolate my rules endpoints into three broad categories, much as the Open PCI Scoping Toolkit does and creating only four general rules.

The groups would be :

L1: PCI servers and workstations
L2: Support servers and IS workstations
L3: General users and tertiary servers  

The four rules sets would be:

L1->L1
L1|L2|L3->L2
L2->L1
L2->L3 

I'm thinking that from here I should be able to simply list all services that might be installed and running on a given level to grant access as outlined above.

L1: SQL, IIS, SMB
L2: SQL, IIS, APP1, APP2, etc

Is there any security problem with defining only four rule sets as outlined using these three levels?

share|improve this question

1 Answer 1

As a former PCI QSA, I would not recommend using the built-in Windows Firewall to segment your card holder environment. The reason being is that this control will only apply to Windows based hosts which are receiving the GPO, in my opinion the control will not provide adequate coverage for the entire card holder environment.

From a coverage standpoint, you are relying on a Windows only control. So unless a separate control is in place to prevent a non Windows computer from obtaining an IP address (e.g., NAC), you could have a OS X or other non Windows device on your network with access to your card holder data.

From a completeness standpoint, you are assuming that every in-scope Windows computer is joined to the domain and will receive the appropriate GPO. So assuming your firewall rules will be limited by individual subnets (e.g., 192.168.1.0/24), there is a chance that a Windows computer NOT receiving the GPO could reside on a subnet that has access to the card holder environment.

My suggestion would be to use a proper firewall with a stateful packet inspection capability to properly segment your network.

Please note: This is my interpretation, another PCI QSA may have a different interpretation of your approach (which is one of the problems of PCI).

share|improve this answer
    
Once segmented only Windows systems would be part of the cardholder environment. By using Windows Advanced Firewall + IPSEC it isn't possible for non authenticated systems (my Linux and OSX boxes included) to access the cardholder environment. –  Tim Brigham Mar 5 '13 at 16:06
    
OK. I write another answer based on this new information. –  Joe Gatt Mar 6 '13 at 21:18
    
The rules are based on security groups in Active Directory, not subnets. There isn't a way for a given IP (windows and joined to our domain or otherwise) to get access without successful authentication (by being a member of the approved group in AD). –  Tim Brigham Mar 6 '13 at 21:21
    
OK. New answer submitted, I hope it helps. –  Joe Gatt Mar 7 '13 at 10:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.