ASD ISM 1528 Utilising evaluated firewalls for network security

IT team should install an evaluated firewall between the organisation's network and the internet.

They can do this by selecting a firewall that meets recognised standards, which means it has been tested for effectiveness. This ensures the firewall can stop unauthorised access effectively.

System owners should work with IT to regularly update firewall settings and software.

This involves scheduling monthly checks to ensure the firewall software is up to date and applying patches provided by the firewall vendor. Doing so minimises vulnerabilities that hackers might exploit.

Managers should provide training to staff on firewall basics and why they're essential.

Arrange for a simple training session with the IT team to explain what the firewall does and why it's crucial for protecting the organisation's information. This helps in creating a culture of security awareness.

Procurement should ensure new firewalls meet the required evaluation standards before purchase.

They can do this by consulting with IT to verify that any new firewall products on the market come with the necessary certification or evaluation reports. This step ensures only capable firewalls are brought into the network.

The IT team should document firewall configurations and changes thoroughly.

Start a log where every change to the firewall settings is recorded with a date and responsible person's name. This record allows for accountability and helps quickly identify if and when a setting needs to be rolled back.