Strategies to Mitigate Cyber Security Incidents (EN)

4.5 Implement and Manage a Firewall on End-User Devices 
Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed. 

4.4 Implement and Manage a Firewall on Servers 
Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent. 

4.4 Внедрен и управляется брандмауэр на серверах
Установить и настроить брандмауэрэкран на серверах

4.5 Внедрен и управляется брандмауэр на конечных пользовательских устройствах
По умолчанию межсетевой экран блокирует трафик, кроме явно разрешенных сервисов и портов.

/STRENGTHENED
The most simple filter consists of blocking access by default to administration ports from workstations (TCP 135, 445 and 3389 ports in Windows, TCP 22 port in Unix), except from explicitly identified resources (administration and user assistance devices, possible management servers requiring access to network shares on devices, etc.). 

An analysis of useful incoming flows (administration, infrastructure software, particular applications, etc.) must be carried out to define the list of authorisations to configure. It is preferable to block all of the flows by default and only authorise the necessary services from the corresponding devices («white list»). 

The firewall must also be configured to log the blocked flows and therefore identify the application configuration errors or intrusion attempts