UMHLABUYALINGANA MUNICIPALITY FIREWALL MANAGEMENT POLICY

UMHLABUYALINGANA MUNICIPALITY FIREWALL MANAGEMENT POLICY

Firewall Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Originator: Recommended by Director of Corporate Services Recommended by EXCO Approved by Council Effective: Review Frequency: Once a year (i.e. Annually) Version Number: FIREWALL MANAGEMENT POLICY Page 2 of 8

TABLE OF CONTENTS 1. Overview... 4 2. Purpose... 4 3. Scope... 4 4. Policy...5 4.1. Installation of the Firewall and Requirements...5 4.2. Firewall management and security requirements... 6 5. Firewall standards... 7 6. Rule base... 7 7. Firewall Settings... 7 8. Connection... 7 9. Location... 8 10. Monitoring of Firewall... 8 11. Enforcement... 8 FIREWALL MANAGEMENT POLICY Page 3 of 8

1. OVERVIEW Firewalls are devices or programs that control the flow of network traffic between networks or hosts that employ differing security postures. Firewalls are used to separate networks with differing security requirements, such as the Internet and an internal network that houses servers with sensitive data. Organisations should use firewalls wherever their internal networks and systems interface with external networks and systems, and where security requirements vary among their internal networks. A firewall policy defines how an organisation s firewall should handle inbound and outbound network traffic for specific IP addresses and address ranges, protocols, applications and content types based on the organisation s information security policies. 2. PURPOSE The purpose of this policy is to describe how the firewall will filter Internet traffic in order to mitigate risks and losses associated with security threats, while maintaining appropriate levels of access for users. 3. SCOPE This policy is applicable to all business units that cause computing devices to be connected to the Umhlabuyalingana Municipality s network. FIREWALL MANAGEMENT POLICY Page 4 of 8

4. POLICY 4.1. INSTALLATION OF THE FIREWALL AND REQUIREMENTS 4.1.1. A Firewall should be implemented to protect the municipality s network. 4.1.2. When implementing the firewall: 4.1.2.1. Permitted connection and protocols, besides for those pre-approved connections, through the firewall must be explicitly defined and approved; 4.1.2.2. The firewall must be configured by default to prohibit all that is not explicitly permitted; 4.1.2.3. The firewall must be managed from a physically secure location; 4.1.2.4. Configuration and log files must be protected against unauthorised access. The integrity of these logs must be protected using checksums, digital signatures or similar measures; 4.1.2.5. The firewall must run on a dedicated machine, which performs no other function; and 4.1.2.6. The firewall must have only the bare minimum software and services resident to reduce the chances of security compromises. 4.1.3. The firewall will at a minimum perform the following security services: 4.1.3.1. Access control between the trusted internal network and untrusted external networks. 4.1.3.2. Block unwanted traffic as determined by the firewall rule set. 4.1.3.3. Hide vulnerable internal systems from the Internet. 4.1.3.4. Hide information, such as system names, network topologies, and internal user IDs, from the Internet. 4.1.3.5. Log traffic to and from the internal network. 4.1.3.6. Provide robust authentication. 4.1.3.7. Provide virtual private network (VPN) connectivity. 4.1.4. The approach adopted to define firewall rule sets is that all services will be denied by the firewall unless expressly permitted in this policy. 4.1.5. The firewall permits the following outbound and inbound Internet traffic. 4.1.5.1. Outbound All Internet traffic to hosts and services outside of the Umhlabuyalingana Municipality. 4.1.5.2. Inbound Only Internet traffic from outside the Umhlabuyalingana Municipality that supports the mission of the Umhlabuyalingana Municipality. 4.1.6. Only necessary protocols should be permitted and all unnecessary IP protocols should be denied by default. 4.1.7. Firewall accounts should be limited to only those that are absolutely necessary, such as the administrator. FIREWALL MANAGEMENT POLICY Page 5 of 8

4.1.8. Compilers, editors, and other program development tools should be removed from the firewall that could enable an unauthorised user to install malicious software or backdoors. 4.1.9. Any feature of the firewall that is not needed should be disabled, including other network access, user shells and applications. 4.1.10. Turn on full-logging at the firewall and review logs on a periodic basis. Logs should be reviewed by the IT Officer. 4.1.11. Statistics on firewall usage should be readily available. 4.2. FIREWALL MANAGEMENT AND SECURITY REQUIREMENTS 4.2.1. All routed connections (including connections to third parties) and connections to the Internet, must be routed through a secure firewall server that has been approved by the municipality. 4.2.2. All firewall configurations must be approved. 4.2.3. Privileges to modify the functionality, connectivity and services supported by the firewall must be restricted to a few individuals with a business need for these privileges. 4.2.4. The IT Officer maintains the implementation and maintenance of the firewall rules on the firewall. 4.2.5. All changes to firewall configuration parameters, rule sets, enabled services and permitted connectivity must be formally logged and follow the change control process. 4.2.6. Current off line backup copies of the firewall configuration file, connectivity permission files, firewall systems administration procedural documentation and related files must be securely stored. 4.2.7. The release of firewall updates (example configuration, version updates) is the responsibility of the IT Officer, who decides on the appropriate level of testing and manner of release of such updates. 4.2.8. The approval of firewall updates is the responsibility of the IT Officer. FIREWALL MANAGEMENT POLICY Page 6 of 8

5. FIREWALL STANDARDS 5.1. Operating System 5.1.1. The firewall must be installed on a hardened operating system (if server based). 5.2. Remote Access 5.2.1. Under no circumstances must remote access to the firewall be supported over un-trusted networks without some form of strong authentication. 5.3. Protocols/Services 5.3.1. Only the necessary services, protocols and applications must be run. 5.3.2. Default services must be checked for appropriateness on a regular basis. 5.3.3. The firewall server must only be used for firewall functions (if server based). 5.3.4. The following programs must never be run on a firewall (if server based): 5.3.4.1. Remote Administration Tools (PCAnywhere, Carbon Copy, etc.) unless precautions have been made to prevent unauthorised access and approved; 5.3.4.2. Telnet server; 5.3.4.3. FTP server; and 5.3.4.4. Mail server/ service. 5.3.5. Allowed protocols and services must be documented with valid business reasons. 6. RULE BASE 6.1. The rule base must deny everything, allowing only that which is specifically authorised. 6.2. A stealth rule must be in place that drops (not rejects) any packets directed towards the firewall. This will ensure that nobody can directly connect or communicate to the firewall, other than administrators that are authorised. 7. FIREWALL SETTINGS 7.1. IP forwarded must be disabled. 7.2. Anti- spoofing must be enabled 7.3. ICMP must be disabled. 8. CONNECTION 8.1. Obtain authorised approval for the connections and protocols that are being allowed through the firewall. FIREWALL MANAGEMENT POLICY Page 7 of 8

9. LOCATION 9.1. The firewall should be located within the computer room at the municipality and managed by the IT Officer. 10. MONITORING OF FIREWALL 10.1. The firewall should be monitored by the IT Officer. 11. ENFORCEMENT 11.1. Non-compliance, violation and disregard of this policy shall result in disciplinary action and sanctions against the employee concerned and such sanctions may lead to termination of the employee s employment contract, depending on the circumstance and the gravity of the transgression. 11.2. In the event of Umhlabuyalingana Municipality incurring financial loss as a result of non-compliance, violation and / or disregard of this policy, Umhlabuyalingana Municipality shall be entitled to institute legal proceedings to recoup the loss it has incurred from the employee / user, and this shall be in addition to the disciplinary action that Umhlabuyalingana Municipality would have taken against the employee. FIREWALL MANAGEMENT POLICY Page 8 of 8