topic Endpoint Firewall rules in Security for SMBs

Endpoint Firewall rules

d46j48fx — Mon, 09 Oct 2023 10:09:01 GMT

Hi colleagues,

Are there any frameworked recommendations for endpoint (host-based) firewall rules for end-user workstations? I understand my request may result in varying opinions...and that's ok. 🙂

I also know that I will need to review the existing buisness-sanctioned connections to ensure I don't break anything that the bsuiness needs to operate. Thanks in advance for any advice, links to frameworks that provide specific guidance etc.

Re: Endpoint Firewall rules

tmekelburg1 — Thu, 07 Apr 2022 18:35:37 GMT

Assuming you're meaning Windows?

Best practices for configuring Windows Defender Firewall - Windows security | Microsoft Docs

CIS Benchmarks (cisecurity.org)

Re: Endpoint Firewall rules

d46j48fx — Thu, 28 Apr 2022 15:24:44 GMT

Apologies for the late response!

Yes, Windows. However, the client will be using SentinelOne, not Windows Defender.

Re: Endpoint Firewall rules

tmekelburg1 — Thu, 28 Apr 2022 17:46:00 GMT

The standard for Windows is to not change any settings on the firewall because Microsoft defaults it to the most secure setting. For SentinelOne, leave it in monitor/audit mode for a few days to view and tailor the alerts for their specific environment. Once you're confident it won't bring their network to a screeching halt, then make it active.