Guideline for a healthy information system v.2.0 (EN)

/STRENGTHENED
The most simple filter consists of blocking access by default to administration ports from workstations (TCP 135, 445 and 3389 ports in Windows, TCP 22 port in Unix), except from explicitly identified resources (administration and user assistance devices, possible management servers requiring access to network shares on devices, etc.). 

An analysis of useful incoming flows (administration, infrastructure software, particular applications, etc.) must be carried out to define the list of authorisations to configure. It is preferable to block all of the flows by default and only authorise the necessary services from the corresponding devices («white list»). 

The firewall must also be configured to log the blocked flows and therefore identify the application configuration errors or intrusion attempts