Chapter 18 — Network and communications security: controls
Lesson map
Lesson 18 published. Map, example, EX052.
flowchart TD
N0["Learning outcomes"]
N1["18.1 Implementing rules"]
N2["18.2 Rule order and overlap"]
N3["18.3 Switch-level controls"]
N4["18.4 Verifying controls"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX052"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 Implementing rules"]
N2["18.2 Rule order and overlap"]
N3["18.3 Switch-level controls"]
N4["18.4 Verifying controls"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX052"]
[Learning outcomes]
|
v
[18.1 Implementing rules]
|
v
[18.2 Rule order and overlap]
|
v
[18.3 Switch-level controls]
|
v
[18.4 Verifying controls]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX052]
Learning outcomes
You will (1) implement zone rules; (2) review rule order; (3) verify controls against requirements.
18.1 Implementing rules
During the summer holiday, Gareth and Tomás implement the firewall rules from the needed-flows list. Each rule has a source zone, destination, service, action and comment naming the flow and requirement. Specific allow rules come first, followed by a final rule denying everything else, as recommended in NIST SP 800-41r1. They implement one zone at a time, testing after each, so that any problem can be traced to the most recent change rather than to a whole batch of rules at once.
18.2 Rule order and overlap
Firewalls usually apply the first matching rule. A broad rule placed early can hide later, more specific ones. Tomás reviews the order and finds a rule allowing staff to reach "any" shared device, placed above a rule intended to block staff from the heating controller, which sits in the shared devices zone. The broad rule would let staff reach the controller. They narrow it to printers and projectors only. Wool's 2004 study of firewall configurations found such ordering errors common, which is why reviews matter.
18.3 Switch-level controls
Some controls live on switches. Unused switch ports are disabled so that nobody can plug in an unknown device in a corridor. Ports in classrooms are assigned to the correct zone. Management access to switches is limited to the management zone. Tomás also enables features that stop a device on one port from pretending to be the network's gateway, a common trick that can redirect traffic. These switch controls complement the firewall by enforcing separation at the point where devices connect.
18.4 Verifying controls
After implementation, Tomás runs the tests from chapter 14. Twenty of twenty-two pass at first. One failure shows a classroom projector unreachable from staff because its new address was mistyped; another shows the guest zone able to reach a shared printer because of a rule using the wrong zone. Both are fixed and the full test list is rerun. Every result is recorded with the date and configuration version, building the evidence that the controls meet the requirements. The results go into the evidence folder.
Worked example
Rules are implemented zone by zone; one broad rule is narrowed; twenty-two tests pass after two fixes.
Synthetic case. Rules and tests are synthetic.
Errors and limits
Broad allow rules placed early can silently override specific restrictions.
Exercises
- EX052 — Broad rule problem. What did the broad staff rule allow by mistake? Rubric: 3 = reaching the heating controller;; 2 = controller;; 1 = printers;; 0 = none.
- EX053 — Unused ports. Why disable unused switch ports? Rubric: 3 = stop unknown devices being plugged in;; 2 = unknown devices;; 1 = power;; 0 = none.
- EX054 — Guest printer failure. What caused the guest-to-printer test failure? Rubric: 3 = rule used wrong zone;; 2 = wrong zone;; 1 = typo;; 0 = none.
Synthesis
Ordered, commented rules plus switch-level controls, verified by tests, enforce the design.
Continue studying — chapter 18 of 30
← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →