Chapter 11 — Security governance, risk and compliance: verification
Lesson map
Lesson 11 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Approved rules"]
N2["11.2 Finding unapproved rules"]
N3["Lab — Verifying firewall rules against an approved l"]
N4["11.3 Investigating and recording"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Approved rules"]
N2["11.2 Finding unapproved rules"]
N3["Lab — Verifying firewall rules against an approved l"]
N4["11.3 Investigating and recording"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]
[Learning outcomes]
|
v
[11.1 Approved rules]
|
v
[11.2 Finding unapproved rules]
|
v
[Lab — Verifying firewall rules against an approved l]
|
v
[11.3 Investigating and recording]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) verify firewall rules against an approved list; (2) investigate unapproved rules; (3) record verification results.
11.1 Approved rules
Fenwick keeps a list of approved firewall rules for its branch network: who may connect to what, on which port. Amina learns that verification compares the actual configuration with the approved list. Differences mean either the list is out of date or the firewall has unapproved rules. PCI DSS v4.0 expects regular review of network security controls, and verification is how that review becomes evidence. Each difference is then resolved one way or the other: the list is updated with approval, or the rule is removed.
11.2 Finding unapproved rules
The lab compares five firewall rules with three approved ones. Three match. Two are unapproved: one allows remote desktop from anywhere to the payment terminal segment on port 3389, and another allows office computers to reach the payment gateway. Amina treats the first as urgent because it exposes payment systems to the internet. She reports both to the IT lead with the evidence. Port 3389 open to the internet on the payment terminal segment is the kind of exposure that PCI DSS segmentation is meant to prevent.
Lab — Verifying firewall rules against an approved list
"""Verify firewall rules against an approved list (synthetic branch firewall)."""
approved = {("any", "web-shop", 443), ("branch-pos", "payment-gw", 443), ("it-admin", "branch-pos", 22)}
rules = [("any", "web-shop", 443), ("branch-pos", "payment-gw", 443), ("it-admin", "branch-pos", 22),
("any", "branch-pos", 3389), ("office", "payment-gw", 443)]
for r in rules: print(r, "approved" if r in approved else "UNAPPROVED")
print(f"rules {len(rules)}; unapproved {sum(r not in approved for r in rules)}")
Run with python3 lab_rules.py. Verified output:
('any', 'web-shop', 443) approved
('branch-pos', 'payment-gw', 443) approved
('it-admin', 'branch-pos', 22) approved
('any', 'branch-pos', 3389) UNAPPROVED
('office', 'payment-gw', 443) UNAPPROVED
rules 5; unapproved 2
11.3 Investigating and recording
The IT lead finds that a support company added the remote desktop rule for a one-off repair and never removed it. The office rule was added when a manager needed to check payments, which should be done through the gateway's web portal instead. Both rules are removed. Amina records the verification, findings, causes and fixes. She learns that verification finds what change control missed, so both controls are needed. The support company's rule also shows why the contract should require temporary rules to be removed after work.
Worked example
Amina verifies five firewall rules, finds two unapproved including an urgent remote desktop exposure and records causes and fixes.
Synthetic case. Rules are synthetic; PCI DSS v4.0 is real.
Errors and limits
Approved lists can be wrong. Verification is periodic.
Exercises
- EX041 — Unapproved count. How many rules were unapproved? Rubric: 3 = two;; 2 = 2;; 1 = three;; 0 = none.
- EX042 — Urgent rule. Which unapproved rule was urgent? Rubric: 3 = remote desktop from anywhere to the payment segment;; 2 = RDP;; 1 = vague;; 0 = none.
- EX043 — RDP cause. Why did the remote desktop rule exist? Rubric: 3 = a support company added it for a one-off repair;; 2 = support;; 1 = vague;; 0 = none.
- EX044 — Two controls. Why are both change control and verification needed? Rubric: 3 = verification finds what change control missed;; 2 = complementary;; 1 = vague;; 0 = none.
Synthesis
Verification against approved lists finds risky drift that change control alone misses.
Continue studying — chapter 11 of 18
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →