.svg)
This security wiki provides information about firewalls and their configuration in the cyber essentials self assessment. Firewalls play a crucial role in protecting your organisation's networks and devices from unauthorised access. Please review the following details related to firewalls and ensure their proper implementation and configuration within your organisation.
Confirm whether firewalls are in place at the boundaries between your organisation's internal networks, laptops, desktops, servers, and the internet. Answer "yes" or "no" to indicate the presence of firewalls at these specified boundaries.
Describe the measures in place to protect devices, including computers used by remote workers, when they are being used away from the workplace and are not connected to the internal network. If applicable, mention the reliance on software firewalls included in the device's operating system for protection.
Ensure that default passwords are changed on all internet routers and hardware firewall devices, even if they come with a unique pre-configured password. Describe the process followed for changing the firewall password.
Provide a brief description of the process for changing the password on your firewall(s).
Specify the configuration of your new firewall password to meet the "Password-based authentication" requirements. Select one of the options below or provide a description if none of the options apply:
A. Multi-factor authentication, with a minimum password length of 8 characters and no maximum length.
B. Automatic blocking of common passwords, with a minimum password length of 8 characters and no maximum length.
C. A password with a minimum length of 12 characters and no maximum length.
D. None of the above (please describe).
Indicate whether you change the firewall password when you suspect or know it has been compromised.
Confirm whether any services are enabled on your firewall that can be accessed externally from the internet.
If services are enabled on your firewall, mention whether there is a documented business case for each of them.
Describe the process followed to disable services on your firewall when they are no longer required.
Ensure that your boundary firewalls are configured to block all other services from being advertised to the internet.
Indicate whether your boundary firewalls allow access to their configuration settings over the internet.
If external access to your firewall settings is permitted, specify whether there is a documented business requirement for this access.
If external access to your firewall settings is allowed, describe the protection mechanism employed. Specify whether it is multi-factor authentication or limited to trusted IP addresses combined with managed authentication.
Confirm whether software firewalls are enabled on all desktop computers, laptops, and servers within your organisation.
If software firewalls are not installed by default as part of the operating system used, provide the reason for their absence and list the operating systems for which this applies.
Implementing and configuring firewalls properly is crucial for safeguarding your organisation's networks and devices. Ensure that the guidelines provided above are followed to enhance the security of your IT infrastructure.
Note: The information provided above is based on general security practices. Organisations should adapt these guidelines to align with their specific requirements and consult with cybersecurity professionals for tailored advice related to firewall configuration.
Contact Periculo for expert cyber security solutions tailored to the digital health industry.
