Personal firewall on by default
Demonstrate that personal firewalls are enabled by default on all managed endpoints and that configurations enforce this state consistently across the enterprise.
Description
What this control does
This control ensures that host-based firewalls on endpoints (workstations, laptops, mobile devices) are enabled by default before deployment and remain active during operation. The personal firewall filters inbound and outbound network traffic based on defined rulesets, blocking unauthorized connections and malicious network activity at the endpoint level. By activating personal firewalls as a baseline configuration, organizations provide defense-in-depth against network-based attacks, lateral movement, and unauthorized data exfiltration even when perimeter defenses are bypassed or unavailable.
Control objective
What auditing this proves
Demonstrate that personal firewalls are enabled by default on all managed endpoints and that configurations enforce this state consistently across the enterprise.
Associated risks
Risks this control addresses
- Attackers exploit unprotected endpoints to establish unauthorized network connections for command-and-control communications
- Malware propagates laterally across the network through endpoints lacking host-based firewall protection
- Unauthorized applications exfiltrate sensitive data via outbound connections that would otherwise be blocked
- Remote attackers directly access services running on endpoints when devices connect to untrusted networks
- Insider threats bypass network monitoring controls by communicating directly from endpoints without firewall filtering
- Ransomware spreads through SMB or RDP connections to endpoints with disabled host firewalls
- Configuration drift results in inconsistent firewall states across the endpoint fleet, creating exploitable gaps in network segmentation
Testing procedure
How an auditor verifies this control
- Obtain the organization's endpoint security baseline configuration documentation and identify the personal firewall settings defined for all endpoint types
- Request firewall configuration exports from the endpoint management platform (GPO, MDM, EDR console) showing default firewall policies applied during provisioning
- Select a representative sample of endpoints across different operating systems, geographic locations, and business units (minimum 25 devices or 10% of population)
- Execute remote queries or use configuration management tools to verify firewall service status on sampled endpoints in real-time
- Review firewall policy rules applied to sampled endpoints, confirming restrictive inbound default-deny rules and controlled outbound policies are active
- Interview IT operations staff to confirm procedures for handling endpoints where firewall services are found disabled or misconfigured
- Examine exception approval records and verify documented business justification exists for any endpoints granted firewall exemptions
- Review automated compliance monitoring dashboards or SIEM alerts to confirm continuous monitoring detects firewall service interruptions
Where this control is tested