Bastion

Detailed View

CRITICAL BA-001 — No Default-Deny Rule at End of Policy

Description: No explicit default-deny (implicit permit-all) rule exists at the end of the access control list or policy group. Traffic not matching any rule is permitted rather than dropped.

Impact: Unintended traffic flows reach internal systems. Attackers can exploit missing coverage to access systems that policy authors assumed were protected.

Remediation: 1. Add an explicit 'deny ip any any log' rule as the final entry in every ACL. 2. Ensure the deny-all rule includes logging to capture all traffic hitting the implicit deny. 3. Review all traffic flows to confirm intended rules precede the default deny. 4. Test the rule using traffic simulation before deploying to production.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7(5)

CRITICAL BA-002 — Any-Any-Any Permit Rule Detected

Description: A firewall rule permits all traffic from any source to any destination on all ports and protocols. This is the most dangerous firewall misconfiguration possible.

Impact: The firewall provides no access control. All traffic is permitted regardless of source, destination, or protocol.

Remediation: 1. Immediately remove or disable the any-any permit rule. 2. Implement principle of least privilege — only permit required traffic flows. 3. Document all required flows before rebuilding the policy. 4. Use a test environment to validate replacement rules before deploying.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NIST 800-53: SC-7

LOW BA-003 — Disabled Rules Present in Production Configuration

Description: One or more firewall rules are disabled (inactive) in the production configuration. Disabled rules accumulate over time and indicate configuration drift or incomplete cleanup.

Impact: Disabled rules represent policy intent that is no longer enforced. They create confusion during audits, may be re-enabled accidentally, and indicate the policy requires cleanup.

Remediation: 1. Review all disabled rules and determine if they are still required. 2. Remove disabled rules that are no longer needed. 3. Document the reason for any disabled rules that must be retained. 4. Establish a policy lifecycle process to prevent accumulation of disabled rules.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

MEDIUM BA-004 — Duplicate Firewall Rules Detected

Description: Two or more firewall rules have identical source, destination, port, and action specifications. Duplicate rules indicate policy bloat and maintenance issues.

Impact: Duplicate rules increase management overhead, create confusion during incident response, and may indicate the policy review process is not working correctly.

Remediation: 1. Identify and remove all duplicate rules. 2. Implement a rule review process that checks for duplicates before policy deployment. 3. Use firewall management tools that flag duplicate rules automatically.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

MEDIUM BA-005 — Shadowed Rules — Unreachable Policy Entries

Description: One or more firewall rules are completely covered (shadowed) by earlier, broader rules and will never be evaluated. Shadowed rules indicate policy maintenance issues and potential security gaps.

Impact: Shadowed rules are never executed. If the shadowing rule has a different action than the shadowed rule, traffic may be handled contrary to policy intent.

Remediation: 1. Reorder rules so more specific rules precede broader rules. 2. Remove rules that are completely redundant given preceding rules. 3. Implement rule ordering verification in change management process.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

LOW BA-006 — Suboptimal Rule Ordering

Description: Frequently-hit rules appear after less-used rules in the policy list. This degrades performance as the firewall must evaluate all preceding rules before reaching the effective rule.

Impact: Increased latency for matching traffic. In high-volume environments, suboptimal ordering can degrade firewall throughput.

Remediation: 1. Place high-volume deny rules (e.g., blocklists) near the top of the policy. 2. Place more specific, lower-volume rules before broad rules. 3. Use hit count data to determine optimal ordering.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CRITICAL BA-007 — RDP Permitted from Any Source

Description: A firewall rule permits Remote Desktop Protocol (RDP, TCP 3389) inbound from any source address. RDP is one of the most commonly exploited services for ransomware and lateral movement.

Impact: Exposed RDP is a primary attack vector for ransomware gangs, APT groups, and commodity attackers. Authentication bypass vulnerabilities (BlueKeep, DejaBlue) regularly affect RDP.

Remediation: 1. Immediately restrict RDP access to specific management IP ranges. 2. Place RDP behind a VPN or RDP Gateway. 3. Enable Network Level Authentication (NLA). 4. Implement account lockout policies. 5. Consider replacing RDP with a zero-trust remote access solution.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

HIGH BA-008 — SSH Permitted from External/Untrusted Sources

Description: A firewall rule permits SSH (TCP 22) from untrusted or external sources. SSH brute-force attacks are extremely common against internet-exposed SSH.

Impact: Exposed SSH enables brute-force attacks, credential stuffing, and exploitation of SSH vulnerabilities. Compromised SSH access provides immediate shell access to the target system.

Remediation: 1. Restrict SSH to management IP addresses only. 2. Implement SSH key-based authentication and disable password authentication. 3. Change SSH to a non-standard port (security by obscurity, not a primary control). 4. Implement fail2ban or equivalent brute-force protection. 5. Consider placing SSH behind a jump host or bastion server.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

NIST 800-53: SC-7

HIGH BA-009 — Telnet Permitted Through Firewall

Description: A firewall rule permits Telnet (TCP 23). Telnet transmits all data including credentials in plaintext and has been deprecated for over 25 years.

Impact: All Telnet communications, including authentication credentials, are transmitted in cleartext and can be intercepted by network eavesdroppers. No confidentiality or integrity protection exists.

Remediation: 1. Immediately block all Telnet traffic. 2. Replace all Telnet-dependent systems with SSH. 3. If Telnet is required for legacy systems, isolate those systems and implement compensating controls. 4. Review device configurations to ensure SSH is enabled on all network equipment.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:M/A:N

NIST 800-53: SC-8

MEDIUM BA-010 — FTP Permitted Through Firewall

Description: A firewall rule permits FTP (TCP 20/21). FTP transmits credentials and data in plaintext and supports anonymous authentication by default on many implementations.

Impact: FTP credentials and file contents are transmitted in cleartext. Anonymous FTP can expose sensitive files. FTP's PORT command can be abused for firewall bypass (FTP bounce attacks).

Remediation: 1. Replace FTP with SFTP (SSH File Transfer Protocol) or FTPS (FTP over TLS). 2. If FTP must be used, restrict to internal networks only. 3. Disable anonymous FTP. 4. Implement strict file transfer policies.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:M/A:N

NIST 800-53: SC-8

CRITICAL BA-011 — SMB Permitted from External Sources (TCP 445)

Description: A firewall rule permits SMB (TCP 445) from external/untrusted sources. SMB is the primary protocol used by ransomware (WannaCry, NotPetya, EternalBlue) for lateral movement.

Impact: Exposed SMB is the most common ransomware infection vector. EternalBlue and related exploits are still widely used in ransomware campaigns. SMB exposure directly enables catastrophic data encryption attacks.

Remediation: 1. Immediately block TCP 445 from all untrusted sources. 2. Block UDP 137-138 and TCP 139 (NetBIOS) as well. 3. Audit internal SMB to ensure it is restricted to required segments. 4. Implement host-based firewall rules in addition to network firewall. 5. Keep Windows systems patched against EternalBlue.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NIST 800-53: SC-7

HIGH BA-012 — MS-RPC Permitted from External Sources (TCP 135)

Description: A firewall rule permits Microsoft RPC (TCP 135) from external sources. MS-RPC is a critical Windows service used for DCOM, WMI, and many Windows management interfaces.

Impact: Exposed MS-RPC enables remote exploitation of Windows services via DCOM and WMI. Historically abused by Blaster, Sasser, and modern APT groups for remote code execution.

Remediation: 1. Block TCP 135 from all external sources. 2. Block the entire RPC dynamic port range (TCP 49152-65535) from external sources. 3. Consider blocking RPC internally except between required systems.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NIST 800-53: SC-7

HIGH BA-013 — NetBIOS Permitted Through Firewall

Description: A firewall rule permits NetBIOS (UDP 137-138, TCP 139) traffic. NetBIOS is a legacy Windows protocol that enables reconnaissance, credential theft (LLMNR/NBT-NS poisoning), and lateral movement.

Impact: NetBIOS enables LLMNR and NBT-NS poisoning attacks, NetBIOS name query reconnaissance, and credential capture via Responder-style attacks. Should never traverse firewall boundaries.

Remediation: 1. Block UDP 137, 138 and TCP 139 at all firewall boundaries. 2. Disable NetBIOS over TCP/IP on Windows hosts where not required. 3. Disable LLMNR and NBT-NS via Group Policy.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:M/A:N

NIST 800-53: SC-7

HIGH BA-014 — SNMP Permitted from Any Source

Description: A firewall rule permits SNMP (UDP 161) from any source address. SNMP exposes device configurations, routing tables, and interface statistics to anyone who can reach the port.

Impact: SNMP v1/v2c use community strings for authentication (effectively cleartext passwords). An attacker with SNMP access can read full device configurations, enumerate network topology, and potentially write configurations if community string permits.

Remediation: 1. Restrict SNMP to dedicated monitoring IP addresses only. 2. Upgrade to SNMPv3 with authentication and encryption. 3. Use ACLs on network devices themselves, not just the firewall. 4. Change default community strings (public/private).

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:M/A:N

NIST 800-53: SC-7

HIGH BA-015 — SNMP v1/v2c Weak Authentication Exposure

Description: SNMP is permitted through the firewall with likely v1/v2c community string authentication. SNMPv1 and v2c use cleartext community strings that can be sniffed.

Impact: Community strings transmitted in cleartext can be captured and used for unauthorized device access. Many devices ship with default community strings (public/private).

Remediation: 1. Migrate to SNMPv3 with AuthPriv security level. 2. If SNMP v1/v2c must be used, restrict to isolated management VLAN. 3. Change all community strings from defaults. 4. Implement SNMPv3 privacy (encryption) for sensitive data.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:L/A:N

NIST 800-53: SC-8

HIGH BA-016 — WinRM Permitted from External Sources (TCP 5985/5986)

Description: A firewall rule permits Windows Remote Management (WinRM, TCP 5985 HTTP or 5986 HTTPS) from external sources. WinRM provides PowerShell remoting and remote command execution.

Impact: Exposed WinRM enables remote command execution via PowerShell. Commonly used by attackers for lateral movement and persistence once credentials are compromised.

Remediation: 1. Block TCP 5985 and 5986 from all untrusted sources. 2. Restrict WinRM to management IP ranges only. 3. Require HTTPS (5986) over HTTP (5985). 4. Implement WinRM access control lists.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

CRITICAL BA-017 — Database Ports Exposed to External Sources

Description: A firewall rule permits database service ports (MySQL TCP 3306, MSSQL TCP 1433, PostgreSQL TCP 5432, Oracle TCP 1521) from external or untrusted sources.

Impact: Direct database exposure enables SQL injection amplification, credential brute-force against database authentication, and direct data exfiltration. Databases should never be directly internet-accessible.

Remediation: 1. Immediately block all database ports from untrusted sources. 2. Place databases in a dedicated database VLAN accessible only from application servers. 3. Implement database activity monitoring (DAM). 4. Use application-layer database proxies where possible.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

CRITICAL BA-018 — Elasticsearch Exposed to External Sources (TCP 9200/9300)

Description: A firewall rule permits Elasticsearch (TCP 9200 HTTP API or 9300 transport) from external or untrusted sources. Elasticsearch has no authentication by default.

Impact: Unauthenticated Elasticsearch instances have led to some of the largest data breaches in history. All indexed data is accessible to anyone who can reach port 9200.

Remediation: 1. Immediately block TCP 9200 and 9300 from all untrusted sources. 2. Enable Elasticsearch security features (X-Pack/Security). 3. Implement TLS and authentication. 4. Place Elasticsearch behind a reverse proxy with authentication.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

CRITICAL BA-019 — Redis/Memcached Exposed to External Sources

Description: A firewall rule permits Redis (TCP 6379) or Memcached (TCP/UDP 11211) from external sources. Both services have no authentication by default.

Impact: Unauthenticated Redis allows full data access and remote code execution via EVAL command. Memcached exposure enables data theft and the service has been abused for massive DDoS amplification attacks.

Remediation: 1. Immediately block TCP 6379 and 11211 from untrusted sources. 2. Enable Redis AUTH and bind to localhost or internal addresses only. 3. Disable Memcached UDP to prevent amplification abuse. 4. Place caching services behind application tier — never expose externally.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

HIGH BA-020 — TFTP Permitted Through Firewall

Description: A firewall rule permits TFTP (UDP 69). TFTP has no authentication mechanism — any client that can reach the TFTP server can read and write files.

Impact: TFTP enables unauthenticated file reads and writes. Attackers who can reach TFTP servers can read configuration files, firmware, and write malicious files.

Remediation: 1. Block UDP 69 at all firewall boundaries. 2. Restrict TFTP to isolated management VLAN if required for network device management. 3. Use SCP or SFTP instead of TFTP for device provisioning.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:H/A:N

NIST 800-53: SC-7

MEDIUM BA-021 — NTP Access Not Restricted to Trusted Sources

Description: A firewall rule permits NTP (UDP 123) from any source without restriction. Open NTP servers can be abused for reflection/amplification DDoS attacks.

Impact: Unrestricted NTP access enables use of the firewall's internal NTP infrastructure as a DDoS amplification source. NTP amplification attacks achieve amplification factors of up to 556x.

Remediation: 1. Restrict NTP to specific trusted time sources (external) and internal clients only. 2. Disable NTP monlist and other amplification-capable commands. 3. Rate-limit NTP responses.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

NIST 800-53: SC-7

LOW BA-022 — DNS Outbound Not Restricted to Authorised Resolvers

Description: Outbound DNS (UDP/TCP 53) is permitted from any internal host to any external destination, allowing direct DNS resolution to arbitrary external servers.

Impact: Unrestricted outbound DNS enables DNS tunneling for data exfiltration, circumvents DNS-based security controls (sinkholes, RPZ), and allows malware to use any DNS server for C2 communication.

Remediation: 1. Restrict outbound DNS to authorised internal resolvers only. 2. Block direct outbound DNS from all hosts except designated resolvers. 3. Implement DNS logging and monitoring. 4. Deploy DNS filtering (RPZ, DNS firewall) on authorised resolvers.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NIST 800-53: SC-7

INFO BA-023 — ICMP Not Restricted

Description: ICMP is permitted without source or destination restriction. While necessary for network diagnostics, unrestricted ICMP enables network reconnaissance and covert channel communication.

Impact: ICMP ping sweeps reveal network topology. ICMP tunneling (iodine, icmptunnel) enables covert data exfiltration. ICMP redirect messages can be used for man-in-the-middle attacks.

Remediation: 1. Restrict inbound ICMP to only needed types (echo-reply, unreachable, time-exceeded). 2. Block ICMP echo from external sources or restrict to monitoring IPs. 3. Consider rate-limiting ICMP.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

NIST 800-53: SC-7

CRITICAL BA-024 — Management Access Not Restricted to Management Zone

Description: Firewall management interfaces (HTTPS, SSH, ASDM) are accessible from any source address, including untrusted networks.

Impact: Unrestricted management access exposes the firewall administrative interface to brute-force attacks, credential stuffing, and exploitation of management interface vulnerabilities.

Remediation: 1. Restrict all management access to a dedicated out-of-band management network. 2. Block all management protocol access from non-management networks. 3. Implement management VLAN with strict access controls. 4. Enable failed login lockout on management interfaces.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

HIGH BA-025 — HTTP Used for Device Management

Description: HTTP (cleartext) is enabled for firewall or device management. All management traffic including credentials is transmitted unencrypted.

Impact: Credentials, session tokens, and configuration changes transmitted via HTTP can be captured by network eavesdroppers. Session hijacking attacks are trivial against HTTP management sessions.

Remediation: 1. Disable HTTP management on all devices. 2. Enable HTTPS with TLS 1.2 minimum. 3. Install a valid management certificate. 4. Redirect any HTTP management connections to HTTPS.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:M/A:N

NIST 800-53: SC-8

CRITICAL BA-026 — Telnet Used for Device Management

Description: Telnet is enabled as a device management protocol. Telnet provides no encryption, authentication challenge-response visibility, or integrity protection.

Impact: All management commands, including configuration changes and credentials, are transmitted in cleartext. An attacker with network access can capture and replay management sessions.

Remediation: 1. Immediately disable Telnet on all devices. 2. Enable SSH version 2 as the sole remote management protocol. 3. Configure SSH with strong cipher suites and MAC algorithms. 4. Remove Telnet from all device configurations.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-8

CRITICAL BA-027 — No Source Restriction on SSH/HTTPS Management Access

Description: SSH or HTTPS management access is configured without a source IP restriction, allowing management access from any network.

Impact: Management access from any source dramatically increases the attack surface for brute-force attacks, credential stuffing, and exploitation of management interface vulnerabilities.

Remediation: 1. Implement source IP restrictions for all management protocols. 2. Create an explicit management ACL restricting access to management workstation IPs. 3. Use an out-of-band management network where possible.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

HIGH BA-028 — HTTPS Management Accessible from Any Source

Description: HTTPS device management is accessible from any source IP address. While HTTPS provides encryption, unrestricted access enables credential attacks.

Impact: Unrestricted HTTPS management enables brute-force and credential stuffing attacks against the management interface. Web-based management interfaces have historically contained exploitable vulnerabilities.

Remediation: 1. Restrict HTTPS management to specific management IP ranges. 2. Implement account lockout after failed login attempts. 3. Enable multi-factor authentication for management access where supported.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:M/A:N

NIST 800-53: SC-7

HIGH BA-029 — Permit Rules Without Logging Enabled

Description: One or more permit (allow) rules do not have logging enabled. Traffic matching these rules is not captured in firewall logs.

Impact: Without logging on permit rules, allowed traffic is invisible to security monitoring. Attacks, data exfiltration, and lateral movement that uses permitted paths cannot be detected or investigated.

Remediation: 1. Enable logging on all permit rules. 2. At minimum, enable logging on high-risk rules (any-source, external-to-internal). 3. Forward logs to a centralised SIEM for correlation. 4. Set log level to 'informational' for permit rules to capture connection details.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST 800-53: AU-2, AU-12

MEDIUM BA-030 — Deny Rules Without Logging Enabled

Description: One or more deny rules do not have logging enabled. Blocked connection attempts are not captured in firewall logs.

Impact: Without logging on deny rules, attack attempts against blocked services are invisible. Security teams cannot detect port scans, reconnaissance, or blocked attack attempts.

Remediation: 1. Enable logging on all deny rules, particularly the default-deny rule. 2. Use logging levels that capture the necessary detail (source IP, destination, port, protocol). 3. Implement log aggregation and alerting for suspicious deny patterns.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:N/A:N

NIST 800-53: AU-2

CRITICAL BA-031 — No Logging Configured — Complete Forensic Blind Spot

Description: No firewall rules in this configuration have logging enabled. The firewall is operating without any security event logging, creating a complete forensic blind spot.

Impact: Without any logging, the organisation cannot detect attacks, investigate incidents, demonstrate compliance, or understand traffic patterns. This is a fundamental security control failure.

Remediation: 1. Immediately enable logging on all permit rules. 2. Enable logging on the default-deny rule. 3. Configure syslog forwarding to a SIEM. 4. Define a log retention policy (minimum 90 days online, 1 year archived). 5. Establish a log review process.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST 800-53: AU-2, AU-12

HIGH BA-032 — No DMZ (Demilitarised Zone) Detected

Description: No DMZ zone or interface has been identified in the firewall configuration. Public-facing services appear to be placed in the same zone as internal systems.

Impact: Without a DMZ, compromising a public-facing server (web, email, DNS) provides direct access to internal systems. This eliminates a critical layer of defence-in-depth.

Remediation: 1. Create a dedicated DMZ zone for all public-facing servers. 2. Configure the DMZ with an intermediate security level. 3. Implement strict policies between DMZ and internal zones. 4. Ensure DMZ servers cannot initiate connections to internal systems.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

NIST 800-53: SC-7

HIGH BA-033 — Direct Internet-to-Internal Permit Without DMZ Intermediate

Description: Permit rules exist that allow direct traffic from the external/internet zone to internal high-trust zones without passing through a DMZ or intermediate inspection zone.

Impact: Traffic from the internet reaches internal systems directly. A single exploitation event on an internet-facing system could lead to direct internal network compromise.

Remediation: 1. Redesign traffic flows to route internet traffic through a DMZ. 2. Place all public-facing services in the DMZ. 3. Implement application-layer inspection between DMZ and internal zones. 4. Require explicit permit rules for DMZ-to-internal traffic.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

HIGH BA-034 — Flat Network — Only One Zone or Interface Defined

Description: The firewall configuration defines only a single zone or network interface. All traffic flows through a single segment with no internal segmentation.

Impact: A flat network means a single compromised host can communicate with any other host. Lateral movement is trivial and ransomware can spread unimpeded.

Remediation: 1. Segment the network into functional zones (internal, DMZ, management, guest). 2. Implement firewall policies between each zone pair. 3. Consider microsegmentation for high-value systems. 4. Progressively add zones as part of a phased network redesign.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

NIST 800-53: SC-7

MEDIUM BA-035 — Server-to-Workstation Traffic Unrestricted

Description: No rules restrict east-west traffic between server and workstation segments. Servers can initiate connections to workstations and vice versa without inspection.

Impact: Unrestricted server-to-workstation traffic enables ransomware propagation, lateral movement from compromised servers to workstations, and from workstations to servers.

Remediation: 1. Implement east-west segmentation between server and workstation VLANs. 2. Deny all server-initiated connections to workstation networks. 3. Permit only required application ports from workstations to servers. 4. Implement network monitoring to detect anomalous east-west traffic.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

NIST 800-53: SC-7

HIGH BA-036 — Internal RFC-1918 Addresses Potentially Reachable Without NAT

Description: Permit rules allow traffic to private (RFC-1918) destination addresses from external zones without corresponding NAT translations, potentially exposing internal addressing.

Impact: If RFC-1918 addresses are routed externally without NAT, internal network topology is exposed. This can enable direct attacks against internal systems or reveal sensitive network design information.

Remediation: 1. Verify that NAT is configured for all rules permitting external traffic to internal RFC-1918 destinations. 2. Ensure that external routing does not leak RFC-1918 prefixes. 3. Implement NAT for all internal-to-external traffic flows.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:M/A:N

NIST 800-53: SC-7

MEDIUM BA-037 — 1:1 Static NAT Exposes Internal Host Directly to Internet

Description: A 1:1 static NAT mapping exposes an internal host directly to the internet with full port translation. All ports on the internal host are potentially reachable.

Impact: Static NAT 1:1 mappings expose the complete attack surface of the mapped internal host. Any vulnerability on that host is directly exploitable from the internet.

Remediation: 1. Replace 1:1 static NAT with port-specific NAT where possible. 2. Implement access control lists in combination with static NAT. 3. Only expose specific required ports, not the full host. 4. Move services requiring internet exposure to a DMZ with strict policies.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:M/A:N

MEDIUM BA-038 — IPv6 Traffic Not Addressed in Policy

Description: The firewall configuration does not include explicit IPv6 policy rules. If IPv6 is enabled on interfaces, traffic may be uncontrolled.

Impact: Unmanaged IPv6 traffic may bypass IPv4 security controls. Dual-stack hosts may be reachable via IPv6 paths that are not covered by the IPv4 firewall policy.

Remediation: 1. Audit all interfaces for IPv6 enablement. 2. If IPv6 is not required, disable it on all interfaces. 3. If IPv6 is used, implement a full dual-stack firewall policy mirroring IPv4 controls. 4. Block IPv6 tunnelling protocols (6to4, Teredo, ISATAP) at the perimeter.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:M/I:M/A:N

NIST 800-53: SC-7

MEDIUM BA-039 — GRE/IPSec Tunnels Permitted Without Authentication Requirement

Description: GRE (protocol 47) or IPSec (ESP/AH, protocols 50/51) tunnelling is permitted without authentication requirements enforced at the firewall level.

Impact: Unauthenticated GRE tunnels can be used to encapsulate and hide malicious traffic, bypassing application-layer inspection. GRE provides no confidentiality or integrity.

Remediation: 1. Replace GRE with authenticated IPSec tunnels. 2. Implement IKEv2 with strong authentication for all VPN tunnels. 3. If GRE is required, encapsulate in IPSec. 4. Implement strict source/destination restrictions on tunnel endpoints.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:M/I:M/A:N

NIST 800-53: SC-8

HIGH BA-040 — BGP/OSPF Routing Protocols Permitted from External Sources

Description: BGP (TCP 179) or OSPF routing protocol traffic is permitted from external or untrusted sources. Routing protocol injection can manipulate network traffic paths.

Impact: Rogue BGP sessions or OSPF updates can redirect traffic to attacker-controlled destinations, enable man-in-the-middle attacks, or cause network-wide outages.

Remediation: 1. Block BGP (TCP 179) from untrusted sources. 2. Implement BGP authentication (MD5 or TCP-AO). 3. Implement OSPF authentication. 4. Restrict routing protocol traffic to dedicated peering addresses.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

NIST 800-53: SC-7

MEDIUM BA-041 — Outbound SMTP Not Restricted to Mail Relay

Description: Outbound SMTP (TCP 25) is permitted from internal networks to any external destination, allowing any internal host to send email directly to external mail servers.

Impact: Unrestricted outbound SMTP enables malware to send spam, phishing emails, and data exfiltration via email from any compromised internal host. This also contributes to IP reputation damage.

Remediation: 1. Block outbound TCP 25 from all hosts except designated mail relays. 2. Route all outbound SMTP through a controlled mail relay/gateway. 3. Implement outbound email filtering and DMARC/SPF/DKIM. 4. Monitor for anomalous outbound email volumes.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:M/A:N

NIST 800-53: SC-7

MEDIUM BA-042 — TLS/SSL Bypass or Inspection Not Configured

Description: Encrypted traffic (HTTPS/TLS) is permitted through the firewall without any indication of SSL/TLS inspection being configured. Malware and data exfiltration commonly use HTTPS to evade detection.

Impact: Encrypted traffic bypasses all application-layer inspection. Malware C2 communications, data exfiltration, and phishing content cannot be inspected or blocked.

Remediation: 1. Implement SSL/TLS inspection where technically and legally feasible. 2. At minimum, block HTTPS to known malicious categories via DNS. 3. Implement certificate pinning bypass detection. 4. Consider decryption zones for high-risk traffic categories.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:N/A:N

NIST 800-53: SC-7

MEDIUM BA-043 — VoIP SIP Permitted Without Restriction

Description: SIP (Session Initiation Protocol, UDP/TCP 5060/5061) is permitted from untrusted sources without source restriction. SIP is commonly targeted for toll fraud and eavesdropping.

Impact: Exposed SIP enables toll fraud (attackers route expensive calls through your infrastructure), eavesdropping on VoIP calls, and SIP scanning for credential harvesting.

Remediation: 1. Restrict SIP to SIP trunk provider IP ranges only. 2. Implement SIP-aware firewall inspection. 3. Deploy a Session Border Controller (SBC). 4. Enable SIP authentication and registration rate limiting.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:M/A:L

NIST 800-53: SC-7

LOW BA-044 — Video Conferencing Ports Unrestricted

Description: Video conferencing service ports (Zoom 8801-8802, Teams 3478-3481, Webex) are permitted from any source without restriction.

Impact: Unrestricted video conferencing ports can be abused for reconnaissance and may expose internal network information through STUN/TURN protocol interactions.

Remediation: 1. Restrict video conferencing traffic to known service provider IP ranges. 2. Use cloud-relay services rather than direct peer connections where possible. 3. Implement application-aware firewall policies for video conferencing.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

NIST 800-53: SC-7

HIGH BA-045 — MQTT IoT Protocol Exposed (TCP 1883/8883)

Description: MQTT broker ports (TCP 1883 unencrypted or 8883 TLS) are accessible from untrusted sources. MQTT is the primary IoT messaging protocol and is frequently misconfigured without authentication.

Impact: Exposed MQTT brokers allow unauthenticated subscription to all IoT device topics, enabling surveillance, control of IoT devices, and lateral movement into IoT network segments.

Remediation: 1. Block MQTT ports from all untrusted sources. 2. Enable MQTT authentication and authorisation. 3. Use TLS-only MQTT (8883). 4. Implement MQTT topic-level access control. 5. Place MQTT broker in isolated IoT VLAN.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

NIST 800-53: SC-7

MEDIUM BA-046 — RDP Permitted on Non-Standard Ports

Description: Remote Desktop Protocol is permitted on non-standard ports (not 3389), suggesting an attempt to obscure RDP exposure. Security by obscurity does not reduce the actual risk.

Impact: RDP running on non-standard ports is discovered by modern port scanners within minutes. The underlying RDP vulnerabilities and risks remain identical regardless of port number.

Remediation: 1. Treat RDP on non-standard ports with the same urgency as standard-port RDP. 2. Implement proper access controls (VPN, specific source IPs) rather than port obfuscation. 3. Consider replacing RDP with a zero-trust remote access solution.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

NIST 800-53: SC-7

CRITICAL BA-047 — Cato WAN Firewall: Any-Any Permit Rule

Description: A WAN firewall rule permits all traffic with no source, destination, or service restrictions across SD-WAN sites.

Impact: Unrestricted site-to-site traffic bypasses intended network segmentation, allowing lateral movement between all connected sites.

Remediation: Replace any-any rules with specific site-to-site policies. Define explicit allowed traffic per application and direction.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NIST 800-53: SC-7

HIGH BA-048 — Cato Internet Firewall: Outbound Any-Any Permit

Description: Internet-bound traffic is permitted without application or destination restriction, bypassing CASB and URL filtering controls.

Impact: Users can reach any internet destination on any port, enabling data exfiltration and access to malicious infrastructure.

Remediation: Enable Cato CASB and URL Filtering. Define explicit application allow-lists for internet access. Block all non-approved traffic by default.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:M/A:N

NIST 800-53: SC-7

MEDIUM BA-049 — Cato: No Identity-Based Policy — All Rules Use IP/Network Only

Description: All firewall rules use IP addresses or network objects with no user or group identity conditions, missing the zero-trust identity layer.

Impact: Any device with a matching IP can traverse permitted paths regardless of user identity, reducing the effectiveness of the SASE model.

Remediation: Migrate rules to identity-based policies using Cato's user/group identity conditions where possible.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:M/I:M/A:N

NIST 800-53: AC-17

HIGH BA-050 — Cloudflare Gateway: No Default Block on Network Policy

Description: No default-deny network policy exists in Cloudflare Gateway. Traffic not matching any explicit rule is passed through.

Impact: Traffic not matching any explicit rule is permitted by default, allowing access to unclassified destinations and services.

Remediation: Add a catch-all network policy at the lowest priority that blocks all unmatched traffic.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:M/A:L

NIST 800-53: SC-7(5)

MEDIUM BA-051 — Cloudflare Gateway: DNS Security Policy Not Configured

Description: No DNS security policies are present. Malicious domain blocking, DoH restrictions, and DNS-based threat intelligence are disabled.

Impact: Users can resolve malicious domains, access phishing sites, and malware can use any DNS server for C2 communication.

Remediation: Enable Cloudflare Gateway DNS filtering. Add policies to block known malware, phishing, and C2 categories.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:M/I:M/A:N

NIST 800-53: SI-3

HIGH BA-052 — Cloudflare Gateway: Unrestricted SSH/RDP in Network Policy

Description: A network policy permits SSH or RDP from any source without identity conditions in Cloudflare Gateway.

Impact: Any user or device matching the network policy can access SSH/RDP endpoints without additional identity verification, defeating zero-trust principles.

Remediation: Add user/group identity conditions to all SSH/RDP rules. Consider migrating to Cloudflare Access for zero-trust remote access.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST 800-53: SC-7

CRITICAL BA-053 — Executive Env: Guest Network Not Isolated from Corporate

Description: Guest/visitor wireless or network segment can communicate with corporate resources. Executive environments are high-value targets and guests must have zero access to internal segments.

Impact: A threat actor, journalist, or corporate spy posing as a visitor could pivot from the guest network to executive communications, email systems, or board-level documents.

Remediation: 1. Isolate guest VLAN with deny-all to all corporate subnets. 2. Permit only internet-bound traffic from guest segment. 3. Implement client isolation on guest wireless. 4. Log all guest traffic to a SIEM.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

NIST 800-53: SC-7

HIGH BA-054 — Executive Env: Personal IoT Devices Reachable from Corporate Network

Description: Rules permit traffic to/from IP ranges or ports associated with consumer IoT devices (smart TVs, streaming, home assistants). These devices typically have poor security hygiene and no patch cadence.

Impact: Nation-state actors routinely compromise executive IoT devices for intelligence gathering. Cross-segment access creates a pivot path to executive communications and data.

Remediation: 1. Create a dedicated IoT VLAN with no route to corporate. 2. Restrict IoT segment to internet-only with content filtering. 3. Block known IoT management ports (8883, 1883, 8888) from corporate. 4. Implement network access control (NAC) to enforce device placement.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:M/A:L

NIST 800-53: SC-7

MEDIUM BA-055 — Executive Env: AV/Conferencing Ports Exposed Internally Without Restriction

Description: Audio/visual and conferencing equipment ports (Crestron, AMX, Extron, Zoom Rooms hardware) are reachable from all internal segments. These devices are rarely patched and frequently have default credentials.

Impact: AV equipment in executive boardrooms and conference rooms can be compromised via network access, enabling audio/video eavesdropping on confidential meetings.

Remediation: 1. Place AV equipment on a dedicated AV VLAN. 2. Restrict access to AV management ports to AV management workstations only. 3. Block Crestron (41794/41796), Extron (23/80), AMX (1319) from general users. 4. Enable logging on all rules touching the AV segment.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:M/I:M/A:L

NIST 800-53: CM-7

HIGH BA-056 — Executive Env: No Zero-Trust Access Control for VPN/Remote Access

Description: Remote access to the executive environment relies on traditional VPN without identity-aware, device-posture-based controls. Executive accounts are high-value phishing targets.

Impact: Compromised VPN credentials grant full network access without posture validation. Executive accounts with VPN access are primary targets for credential theft and phishing campaigns.

Remediation: 1. Implement zero-trust network access (ZTNA) for all executive remote connections. 2. Require MFA with phishing-resistant methods (FIDO2/hardware token) for all access. 3. Enforce device posture checks before granting access. 4. Log and alert on all executive remote access sessions.

Effort: long_term

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

NIST 800-53: AC-17

CRITICAL BA-057 — Executive Env: Logging Disabled on Rules Covering Executive Subnets

Description: Permit rules covering identified executive subnets have logging disabled, creating a forensic blind spot in the highest-value segment of the network.

Impact: Without logging on executive network segments, security teams cannot detect or investigate threats targeting the most sensitive users and data in the organisation.

Remediation: Enable logging on ALL rules that permit traffic to or from executive subnets. Route logs to immutable SIEM storage. Set alerts for anomalous connection patterns.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST 800-53: AU-2, AU-12

HIGH BA-058 — Firewall Rule Permits Traffic to Known Malicious IP ({ip})

Description: A firewall rule permits traffic with a source or destination address that is flagged as KNOWN MALICIOUS by multiple threat-intelligence sources. The IP is confirmed as malicious infrastructure (C2, botnet node, compromised host, or hijacked network).

Impact: This rule allows network traffic to/from an IP address confirmed as malicious infrastructure. Active communication with this IP may indicate an ongoing compromise, data exfiltration, or command-and-control activity.

Remediation: 1. Immediately add a deny rule for the malicious IP above this permit rule. 2. Investigate firewall logs for any traffic to/from the IP. 3. If traffic occurred, treat as a potential incident — isolate affected hosts and begin forensic analysis. 4. Review the rule to determine if it can be narrowed.

Effort: immediate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

MITRE ATT&CK: T1071 (Command and Control)

NIST 800-53: SC-7

MEDIUM BA-059 — Firewall Rule Permits Traffic to Suspected Malicious IP ({ip})

Description: A firewall rule permits traffic with a source or destination address flagged as SUSPECTED malicious by threat-intelligence sources. The IP has been observed in attack activity, scanning, or brute-force attempts but is not yet confirmed as malicious.

Impact: This rule allows traffic to/from an IP reported as suspicious by multiple threat-intelligence sources. While not confirmed malicious, the IP has been observed in attack activity, scanning, or brute-force attempts. Permitting traffic increases exposure to potential threats.

Remediation: 1. Review whether traffic to/from the IP is expected and business-justified. 2. If not, add a deny rule above the permit. 3. Monitor traffic to/from the IP for anomalous patterns. 4. Subscribe to threat-intel updates for the IP.

Effort: short_term

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:M/I:M/A:N

MITRE ATT&CK: T1071 (Command and Control)

NIST 800-53: SC-7

INFO BA-060 — Firewall Rule Blocks Known Malicious IP ({ip})

Description: A firewall rule correctly denies traffic with a source or destination address that is flagged as KNOWN MALICIOUS by threat-intelligence sources. The deny rule is actively blocking malicious traffic.

Impact: Positive observation: the firewall is actively blocking traffic to/from a confirmed malicious IP. This indicates effective threat-intel integration in the firewall policy.

Remediation: No action required — the deny rule is correctly blocking the malicious IP. Ensure this rule remains in place and is not overridden by a broader permit rule above it in the policy.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N

NIST 800-53: SC-7