Define the Initial Internet Gateway Security Policy
The overall goal of a best practice internet gateway
security policy is to use positive enforcement of whitelist applications.
However, it takes some time to identify exactly what applications
are running on your network, which of these applications are critical
to your business, and who the users are that need access to each
one. The best way to accomplish the end goal of a policy rulebase
that includes only application allow rules is to create an initial
policy rulebase that liberally allows both the applications you
officially provision for your users as well as other general business and,
if appropriate, personal applications. This initial policy also
includes additional rules that explicitly block known malicious
IP addresses, bad applications as well as some temporary allow rules
that are designed to help you refine your policy and prevent applications
your users may need from breaking while you transition to the best
practices.
The following topics describe how to create the initial rulebase
and describe why each rule is necessary and what the risks are of
not following the best practice recommendation:
Related Documentation
Identify Whitelist Applications
Identify Whitelist Applications The application whitelist includes not only the applications you provision and administer for business and infrastructure purposes, but also other applications that ...
Step 3: Create the Application Block Rules
Step 3: Create the Application Block Rules Although the overall goal of your security policy is to safely enable applications using application whitelist rules (also ...
How Do I Deploy a Best Practice Internet Gateway Security P...
How Do I Deploy a Best Practice Internet Gateway Security Policy? Moving from a port-based security policy to an application-based security policy may seem like ...
Remove the Temporary Rules
Remove the Temporary Rules After several months of monitoring your initial internet gateway best practice security policy, you should see less and traffic hitting the ...
Why Do I Need a Best Practice Internet Gateway Security Pol...
Why Do I Need a Best Practice Internet Gateway Security Policy? Unlike legacy port-based security policies that either block everything in the interest of network ...
Best Practice Internet Gateway Security Policy
Best Practice Internet Gateway Security Policy One of the cheapest and easiest ways for an attacker to gain access to your network is through users ...
Use Temporary Rules to Tune the Whitelist
Use Temporary Rules to Tune the Whitelist Although the end-goal of a best-practice application-based policy is to use positive enforcement to safely enable your whitelist ...
Application Whitelist Example
Application Whitelist Example Keep in mind that you do not need to capture every application that might be in use on your network in your ...