Normalizing Windows Advanced Firewall rules

Question

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen have centered on locally defined firewall rules or had dozens of group policies.

I have been thinking it would make sense to extrapolate my rules endpoints into three broad categories, much as the Open PCI Scoping Toolkit does and creating only four general rules.

The groups would be :

L1: PCI servers and workstations
L2: Support servers and IS workstations
L3: General users and tertiary servers  

The four rules sets would be:

L1->L1
L1|L2|L3->L2
L2->L1
L2->L3 

I'm thinking that from here I should be able to simply list all services that might be installed and running on a given level to grant access as outlined above.

L1: SQL, IIS, SMB
L2: SQL, IIS, APP1, APP2, etc

Is there any security problem with defining only four rule sets as outlined using these three levels?

Answer 1

As a former PCI QSA, I would not recommend using the built-in Windows Firewall to segment your card holder environment. The reason being is that this control will only apply to Windows based hosts which are receiving the GPO, in my opinion the control will not provide adequate coverage for the entire card holder environment.

From a coverage standpoint, you are relying on a Windows only control. So unless a separate control is in place to prevent a non Windows computer from obtaining an IP address (e.g., NAC), you could have a OS X or other non Windows device on your network with access to your card holder data.

From a completeness standpoint, you are assuming that every in-scope Windows computer is joined to the domain and will receive the appropriate GPO. So assuming your firewall rules will be limited by individual subnets (e.g., 192.168.1.0/24), there is a chance that a Windows computer NOT receiving the GPO could reside on a subnet that has access to the card holder environment.

My suggestion would be to use a proper firewall with a stateful packet inspection capability to properly segment your network.

Please note: This is my interpretation, another PCI QSA may have a different interpretation of your approach (which is one of the problems of PCI).