Install and Maintain a Firewall Configuration (PCI-1)

Written By Jeremy Pickett
“Cybersecurity is a shared responsibility, and it boils down to this: in cybersecurity, the more systems we secure, the more secure we all are.”
— Jeh Johnson

Firewalls are your first line of defense in the PCI DSS battlefield, standing guard between your precious cardholder data and the wild west of external networks. Properly implemented and vigilantly maintained, they're not just a compliance checkbox—they're the digital fortification that could mean the difference between secure transactions and a headline-making data breach.

These steps are a basic steps for remediation for Windows, OSX, Linux, AWS, GCP, and Azure. As tool change, remediation advice changes. This entry maps to the PCI DSS code referenced in the entry. Please check back regularly for updates to this library entry.

These are the starting points for a conversation. As the documentation and Library grows and evolve, expect much deeper technical dives. Security is not a product, it is a process.

Why the Control Matters

Implementing and maintaining a robust firewall configuration is a critical first line of defense in protecting cardholder data. Firewalls act as a barrier between trusted internal networks and untrusted external networks, controlling incoming and outgoing network traffic based on predetermined security rules. This control is fundamental in preventing unauthorized access to sensitive cardholder information and mitigating potential security breaches.

Real World Impact

In the real world, proper firewall implementation can mean the difference between a secure transaction environment and a catastrophic data breach. For instance, in 2013, Target fell victim to a massive data breach that compromised 40 million credit and debit card accounts. Investigations revealed that while Target had a firewall in place, it wasn't configured to adequately segregate cardholder data from the rest of the network. This incident underscores the importance of not just having a firewall, but ensuring it's properly configured and maintained.

Components of Implementation

On-Premises Implementation:

  • Hardware firewalls at network perimeters

  • Software firewalls on individual servers and workstations

  • Regular updates to firewall firmware and software

  • Documented firewall rules and change management processes

  • Segmentation of cardholder data environment from other networks.

Cloud Implementation:

  • Virtual firewalls or security groups

  • Web Application Firewalls (WAF) for public-facing applications

  • Cloud-native security controls like AWS Security Groups or Azure Network Security Groups

  • Proper configuration of cloud service provider's security features

  • Regular audits of cloud security configurations

Responsibility Matrix

Who is Responsible for the Work:

  • IT Security team: Primary responsibility for firewall implementation and rule sets

  • Network team: Assisting with network architecture and segmentation

  • System administrators: Implementing and maintaining host-based firewalls

Who is Responsible for the Lifecycle:

  • IT Security team: Ongoing monitoring, updates, and audits of firewall configurations

  • Compliance team: Ensuring firewall policies align with PCI DSS requirements

  • Management: Approving resources and budget for firewall maintenance and upgrades

Interdependencies

The firewall control is closely interlinked with other PCI DSS requirements:

  • Network segmentation (Requirement 1.2)

  • Secure system configurations (Requirement 2)

  • Logging and monitoring (Requirement 10)

  • Regular security testing (Requirement 11)

Effective implementation of these controls reinforces the overall security posture and enhances the efficacy of the firewall.

Challenges and Solutions

Challenge 1: Complexity of Rule Management Solution: Implement a robust change management process. Utilize automated tools for rule analysis and optimization. Regularly review and prune unnecessary rules.

Challenge 2: Cloud Environment Complexity Solution: Leverage cloud-native security tools and implement Infrastructure as Code (IaC) for consistent security configurations. Conduct regular cloud security posture assessments.

Challenge 3: Keeping Up with Evolving Threats Solution: Implement next-generation firewalls with intrusion prevention capabilities. Subscribe to threat intelligence feeds and regularly update firewall rules based on new threat information.

Challenge 4: Balancing Security and Business Needs Solution: Adopt a risk-based approach to firewall rule implementation. Engage with business units to understand their needs and implement least-privilege access policies.

Best Practices

  1. Document all firewall rules and configurations

  2. Implement a formal change management process for firewall modifications

  3. Conduct regular firewall rule reviews and audits

  4. Use automated tools for continuous compliance monitoring

  5. Implement network segmentation to isolate cardholder data environment

  6. Regularly train IT staff on firewall management and security best practices

Remediation: On-Prem

windows

Enable and configure Windows Firewall with Advanced Security

  1. Implement Group Policy Objects (GPOs) to manage firewall rules across the domain

  2. Use Windows Server Update Services (WSUS) to manage and deploy security updates

  3. Implement Windows Defender Application Control (WDAC) to restrict unauthorized applications

  4. Use PowerShell scripts for automated firewall rule auditing and reporting

  5. Configure Windows Event Forwarding for centralized logging

  6. Implement Network Access Control (NAC) to enforce security policies on network connections

macOS

Enable and configure the built-in macOS firewall

  1. Use Profile Manager or third-party MDM solutions for centralized management of firewall settings

  2. Implement Little Snitch or similar third-party firewall solutions for advanced control

  3. Use Jamf Pro or similar tools for automated software updates and security configurations

  4. Configure syslogd for centralized logging

  5. Implement Open Source HIDS SECurity (OSSEC) for intrusion detection

linux

  1. Configure and enable iptables (for older systems) or nftables (for newer systems)

  2. Use UFW (Uncomplicated Firewall) on Ubuntu for easier firewall management

  3. Implement SELinux (Red Hat) or AppArmor (Ubuntu) for mandatory access control

  4. Use Ansible for automated firewall configuration and management across systems

  5. Configure rsyslog for centralized logging

  6. Implement fail2ban to protect against brute-force attacks

  7. Use Lynis for automated security auditing and hardening

Procedures (All Platforms)

Develop and maintain a comprehensive firewall policy document

  1. Implement a formal change management process for firewall rule modifications

  2. Conduct regular firewall rule reviews and audits (e.g., quarterly)

  3. Perform annual penetration testing and vulnerability assessments

  4. Establish an incident response plan specific to firewall-related security events

  5. Provide regular training for IT staff on firewall management and security best practices

  6. Implement a vendor management process to ensure timely security updates for all systems

  7. Develop and maintain network diagrams showing all connections to cardholder data, including wireless networks

  8. Implement a formal process for approving and testing all network connections and changes to firewall configurations

  9. Establish a procedure for insecure services, protocols, and ports to be explicitly prohibited if not necessary for business

Hardware Firewalls

It is critical, and perhaps triply critical that services, needs, topology and diagrams are agreed upon before changes, additions, replacements are made. If the need for a service is not fully understood by stakeholders, that is always the first step.

Cisco

  1. Implement Cisco Adaptive Security Appliance (ASA) or Firepower Next-Generation Firewall (NGFW)

  2. Configure access control lists (ACLs) to restrict traffic based on source, destination, and service

  3. Enable Cisco Security Intelligence for real-time threat intelligence

  4. Implement Cisco AnyConnect for secure remote access

  5. Configure zone-based policy firewall for better segmentation

  6. Enable logging and configure Cisco Firepower Management Center for centralized management

  7. Implement Cisco Talos for advanced threat intelligence and protection

  8. Use Cisco Prime Infrastructure for network management and monitoring

  9. Configure Network Address Translation (NAT) to hide internal IP addresses

  10. Implement Cisco TrustSec for software-defined segmentation

Juniper

  1. Deploy Juniper SRX Series Services Gateways for next-generation firewall capabilities

  2. Configure security zones and policies to control inter-zone traffic

  3. Implement Juniper Sky Advanced Threat Prevention (ATP) for cloud-based threat intelligence

  4. Use Juniper Secure Connect for secure remote access

  5. Configure J-Web or Junos Space Security Director for centralized management

  6. Implement application visibility and control features

  7. Enable Juniper's Intrusion Detection and Prevention (IDP) services

  8. Configure log forwarding to a centralized log management system

  9. Implement UserFW for user identity-based access control

  10. Use Juniper's Security Intelligence (SecIntel) for threat feed integration

Palo Alto Networks

  1. Deploy Palo Alto Networks Next-Generation Firewall (NGFW)

  2. Implement App-ID for application-level visibility and control

  3. Configure User-ID for user identity-based policies

  4. Enable Threat Prevention features including IPS, anti-malware, and DNS security

  5. Implement GlobalProtect for secure remote access

  6. Use Panorama for centralized management and logging

  7. Configure Dynamic Address Groups for flexible policy management

  8. Implement Palo Alto Networks WildFire for advanced threat analysis

  9. Enable URL Filtering for web content control

  10. Use PolicyOptimizer to analyze and optimize security policies

Sonicwall

  1. Deploy SonicWall TZ or NSa series next-generation firewalls

  2. Configure zone-based firewall policies

  3. Implement SonicWall Capture Advanced Threat Protection (ATP) for sandboxing

  4. Use SonicWall Global Management System (GMS) for centralized management

  5. Enable Real-Time Deep Memory Inspection (RTDMI) for advanced threat detection

  6. Configure SonicWall Secure Mobile Access for remote access

  7. Implement application intelligence and control features

  8. Enable Gateway Anti-Virus and Anti-Spyware protection

  9. Configure SonicWall Analyzer for advanced reporting and analytics

  10. Use Botnet filtering to block command and control traffic

General Procedures

  1. Develop and maintain a comprehensive firewall change management process

  2. Implement a formal process for regular firewall rule review and cleanup

  3. Establish a procedure for testing and approving firewall changes before implementation

  4. Create and maintain up-to-date network diagrams showing all firewall placements

  5. Implement a process for regular firmware updates and security patches

  6. Conduct annual penetration testing and vulnerability assessments

  7. Establish and test an incident response plan specific to firewall-related events

  8. Provide regular training for IT staff on firewall management and security best practices

  9. Implement a formal process for firewall log review and analysis

  10. Establish a procedure for secure remote access to firewall management interfaces

Best Practices

  1. Implement the principle of least privilege for firewall administrative access

  2. Use strong, unique passwords and multi-factor authentication for firewall management

  3. Disable unused services and close unnecessary ports

  4. Implement network segmentation to isolate the cardholder data environment

  5. Configure stateful inspection for all allowed traffic

  6. Implement proper backup and disaster recovery procedures for firewall configurations

  7. Use HTTPS or SSH for remote management, never telnet or HTTP

  8. Implement Network Time Protocol (NTP) for accurate time synchronization

  9. Configure SNMP monitoring, but disable SNMP write access

  10. Regularly review and update firewall rules to remove outdated or unnecessary rules

Remediation: Cloud

Amazon aWS

  1. Implement and configure AWS Network Firewall for network-level protection

  2. Use Security Groups as instance-level firewalls for EC2 instances

  3. Configure Network Access Control Lists (NACLs) for subnet-level security

  4. Implement AWS Web Application Firewall (WAF) for protecting web applications

  5. Use AWS Config to continuously monitor and assess firewall configurations

  6. Leverage AWS CloudTrail for comprehensive logging of all API actions

  7. Implement AWS GuardDuty for intelligent threat detection

  8. Use AWS Systems Manager for automated patching and configuration management

  9. Implement AWS Transit Gateway for centralized network management

  10. Use AWS Control Tower for setting up and governing a secure multi-account AWS environment

Google GCP

  1. Configure and use Cloud Firewall Rules for network-level traffic control

  2. Implement Cloud Armor for web application and DDoS protection

  3. Use VPC Service Controls to define security perimeters around resources

  4. Leverage Identity-Aware Proxy (IAP) for context-aware access to applications and VMs

  5. Implement Cloud Security Command Center for centralized visibility and control

  6. Use Stackdriver (now Google Cloud Operations Suite) for logging and monitoring

  7. Implement Cloud Key Management Service (KMS) for encryption key management

  8. Use GCP Security Health Analytics for automated security scanning

  9. Implement Forseti Security for continuous monitoring and policy enforcement

  10. Use Terraform or Deployment Manager for Infrastructure as Code (IaC) and consistent security configurations

Azure

  1. Implement and configure Azure Firewall for network-level protection

  2. Use Network Security Groups (NSGs) for granular traffic control

  3. Implement Azure Web Application Firewall (WAF) on Azure Application Gateway

  4. Use Azure DDoS Protection for safeguarding against DDoS attacks

  5. Leverage Azure Security Center for unified security management and threat protection

  6. Implement Azure Sentinel for intelligent security analytics

  7. Use Azure Monitor and Log Analytics for comprehensive logging and monitoring

  8. Implement Azure Policy for enforcing organizational standards and assessing compliance

  9. Use Azure Blueprints for consistent cloud environment creation

  10. Implement Just-In-Time (JIT) VM Access to reduce exposure to attacks

Procedures (All Platforms)

  1. Develop a cloud-specific security policy aligned with PCI DSS requirements

  2. Implement a formal process for cloud resource provisioning and deprovisioning

  3. Establish a regular schedule for reviewing and optimizing cloud security configurations

  4. Conduct annual cloud-focused penetration testing and vulnerability assessments

  5. Develop and maintain cloud network diagrams showing all connections to cardholder data

  6. Implement a formal change management process for cloud security configurations

  7. Provide regular training for IT staff on cloud security best practices and platform-specific security features

  8. Establish a cloud incident response plan and conduct regular drills

  9. Implement a process for continuous compliance monitoring in cloud environments

  10. Develop and maintain a shared responsibility matrix clearly defining security responsibilities between your organization and the cloud provider

Cloud-Specific Best Practices:

  1. Use multi-factor authentication (MFA) for all cloud console access

  2. Implement the principle of least privilege for all cloud IAM policies

  3. Regularly rotate and manage cloud access keys and secrets

  4. Use private endpoints or VPN connections for secure access to cloud resources

  5. Implement data encryption at rest and in transit

  6. Regularly back up critical data and test restoration procedures

  7. Use cloud-native security information and event management (SIEM) solutions

  8. Implement network segmentation in cloud environments to isolate cardholder data

  9. Utilize cloud cost management tools to identify and investigate unexpected resource usage, which could indicate a security issue

  10. Regularly review and optimize Identity and Access Management (IAM) configurations

Jeremy Pickett
Next

Coming Soon