So that's personal firewalls.
In my view,
personal firewalls are in requirement 1 because it has the word firewall in it,
because it feels to me like it's actually something about operating system
configuration and would sit better in requirement 2.
But look, gosh,
they also strike me as a throwback to when if you plugged
something into like even your home network,
there was no firewall.
Remember the days when we plugged everything straight into the internet,
and we all got worms, which is why this requirement really came out,
because of worming type of behaviors.
So is this something I worry about,
or can I just use what's in my operating system?
You can use what's in the operating system or at the Windows
or the macOS sort of provided firewall.
The place I typically see this applied are for the administrators,
the IT people that are remoting into the in-scope environment to do their jobs,
the managing environment.
And so this is protecting the environment from those
workstations as maybe an attack entry point.
And the particulars of the requirement say,
one,
that you configure the firewall rules according to some
company-defined standards and that the employee is not able to
alter or disable the functionality.
And so if you can do that with the Windows firewall or with the
macOS firewall or whatever the operating system is,
then sure, you can absolutely use that.
I just think we hit a non sequitur there.
So if one of the real targets is the system
administrator who might be remoting in,
the system administrator is usually the person who could
change the personal firewall settings.
There is that.
I'm glad you brought that up.
What I've seen in that case is that sometimes you have these kind of
non-overlapping administrative responsibilities.
Yeah.
But sometimes you don't,
and the administrator is the administrator for everything,
particularly in smaller organizations with fewer IT people.
What we go for there is some sort of written policy saying as the
administrator using your workstation to access this environment,
you will insert these controls here.
You will not monkey with them.
Keep them in place.
Obviously,
you have the rights to do that because that's part of your job function,
but don't kind of undo that while you're protecting your
workstation in the course of this.
And when you're assessing this, is this a sample control?
Do you just pick random workstations and walk up to them?
We pick workstations that are relevant,
that have remote access into the environment.
Or if there are workstations that are in the environment,
like in a contact center or something like that,
then we might grab those workstations.
And yeah, we will sample them.
Rather than kind of physically walking up to them,
at least in most cases, we're looking at some sort of tool that,
like the Active Directory domain policy application to individual
computers house as a means of gathering that sample.
But yes, we do sample it.
So architecturally,
I mean one of my questions always is architecturally can is something an
organization can do to make this requirement easier to fulfill.
Right.
So some sort of central management over this.
Yes, absolutely.
Right.
I think without the central management,
you have a much harder time where the employee cannot
disable or modify the function.
So I suppose it's possible to do it without it,
but it's much, much more challenging.
And what barriers do organizations have to implementing this?
It's usually just a question of kind of the effort and the setup of doing so.
Again,
particularly if you're relying on the operating system
sort of brass tacks for the firewall,
it's not like you have software infrastructure costs.
So if you don't have this in place, it's,
I'd say, again,
relatively easy to deploy compared to some of the other requirements,
but there are all kinds of organizations that have all kinds of challenges.