SC.L2-3.13.6Network Communication By Exception
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
[a]
network communications traffic is denied by default; and[b]
network communications traffic is allowed by exception.
Default-deny rulebases north-south and east-west, with exceptions that expire
Implementation
AO coverage. Addresses both Network Communication By Exception objectives: deny by default, allow by exception.
Deny by default [a]. Every rulebase ends in an explicit deny-all-and-log rule, and the implicit deny is never relied on for evidence. This applies to inbound internet, outbound internet from the enclave, and east-west between segments. Cloud security groups start from an empty ingress set; a resource that gets no rule gets no traffic.
Allow by exception [b]. A permit rule exists only if a ticket exists. The ticket records requester, business justification, source, destination, port, whether CUI traverses the path, approver (someone other than the requester), and an expiry date. Rules are named with the ticket ID so an auditor can walk from any line in the rulebase back to its authorization.
Outbound is treated like inbound. Enclave egress is an FQDN and IP allow-list covering SaaS apps, OS and AV update services, and the two supplier SFTP hosts. Everything else is denied and logged, which is also how the organization notices unexpected software phoning home.
Change discipline. Nightly config backup with a diff alert to the network channel. A rule that appears without a matching ticket generates a review item the next business morning, including rules added during an incident, which are reconciled within 24 hours.
Maintenance. Monthly expiry sweep: rules past their date are disabled first and removed after a week's grace. Quarterly hit-count review; zero-hit rules over 90 days are proposed for removal. Semi-annual reconciliation of the rulebase against the exception register.
Accepted gap. One legacy building-automation controller needs broad outbound access to a vendor cloud that publishes no stable address list. It sits on a non-CUI VLAN with no route to the enclave, and its traffic is logged even though it is not narrowly filtered.
What the evidence looks like
- Firewall and security group exports showing the terminal deny-all-and-log rule
- Sample permit rules with ticket IDs in the rule names, matched to their tickets
- Enclave egress allow-list with justification per destination
- Config diff alert history and a reconciled emergency-change ticket
- Monthly expiry sweep and quarterly hit-count review records
Environment
Tools
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.