This is Susan Bradley for CSO online today I'm going to talk about one thing
in a Windows machine that you're probably not used using enough of one
thing that you probably turned off years ago and disabled and you're probably
just now using it one thing that in Windows XP made a huge difference in
allowing it to protect the operating system from computer worms and that one
thing is the Windows Firewall now if you're as old as I am you probably have
at least one more story or maybe more about how the Windows Firewall was
either the horrible bane of your existence or something that was your
friend I still remember a technology conference that I was at where the tech
floor show people were setting up Windows machines and they hadn't turned
on the Windows Firewall and it happened to be the day that a worm came out on
the internet and here they had all of these these machines set up on the web
but the firewalls not on and you can only imagine what happened you got it a
whole bunch of machines rebooting all at the same time and people on the staff
didn't know what to do with it needless to say it took a whole extra day for the
floor staff to put two machines back into operation so that they could
demonstrate the technology offerings to the intende ease since Windows XP
service pack 2 the Windows Firewall has been enabled by default and how many of
us came in here and turned it off because it was too much of a bother
now in Windows 10 Server 2019 the vast majority of needed firewall policies are
already built into the firewall when you start a wizard especially in Server 2019
and you build that rule to install a role it automatically builds the
firewall policy for you now I recommend that when you set up a firewall role
that you don't set it up by a port but you actually set it up with the
application in mind so that if the application is on and enabled it will go
out when it needs to if you open it by port
keeps that port open at all times so remember build a rule by application not
by port next I always recommend that you go into the properties of the firewall
and you go into settings and customize and you make sure that the display and
notification is enabled when a program is blocked from receiving inbound
connections this will help you in setting up your firewall rules you can
also look for event 503 1 the Windows Firewall service blocked an application
from accepting incoming connections and this will tell you the application and
what profile it's trying to go out on here's another new recommendation you
can use the firewall to restrict powershell of going out to the Internet
now why is this a good thing attackers use PowerShell these days to pull
information from the web so if you block PowerShell from going outside of your
local domain it means you can protect your network better so run this command
that allows you to protect from multiple powershell binaries and once you run it
it'll say ok and you'll notice once you go into the powershell excuse me of the
firewall roles you'll notice that you have the PS allow LAN and PS deny all
the two rules that were set up using that command finally I always recommend
that when reviewing the security status of your network that you take a random
sample of workstations on a regular basis and audit the settings in the
machine review the firewall policies on each sample workstation I'm often
surprised about application that that have built rules for themselves if I
have forgotten to build a blocking rule take the time to use and understand how
powerful the Windows Firewall can be in your organization until next time don't
forget check out for more on IDG tech talk out on YouTube
this is Susan Bradley for CSO online
you