Firewall configuration best practices

When configuring any firewall product for use onAVEVA Enterprise SCADA systems, there are a number of best practices you should always follow:

1. Plan out your network structure so that you can group these assets together and place them into networks (or zones) based on similar sensitivity level and function. Use internal IP addresses for all of your internal networks.

2. Once you have designed your network zone structure and established the corresponding IP address scheme, you are ready to create your firewall zones and assign them to your firewall interfaces or sub-interfaces. As you build out your network infrastructure, use switches that support virtual local area networks (VLANs) to maintain level-two separation between the networks.

3. You should determine exactly which traffic needs to be able to flow into and out of each zone. Firewall rules, which are applied to each interface or sub-interface on the firewall, will determine the allowable traffic. Make the rules specific to the exact source and/or destination IP addresses and port numbers whenever possible. At the end of firewall rules, make sure there is a "deny all" (or "block") rule to filter out all unapproved traffic.

4. Apply both inbound and outbound rules to each interface and sub-interface on your firewall so that only approved traffic is allowed into and out of each zone.

5. Whenever possible, it is generally advised to disable your firewall administration interfaces (including both secure shell [SSH] and web interfaces) from public access. This will help to protect your firewall configuration from outside threats. Make sure to disable all unencrypted protocols for firewall management, including Telnet and HTTP connections.

6. After creating the firewall configuration, have a security expert review your configuration to make sure it is set up to keep your data as safe as possible. First verify that your firewall works as intended on the test environment. When testing the firewall rules, be sure to turn on the logging of all traffic, which will assist you in verifying that your firewall is blocking that which should be blocked, and is allowing that which should be allowed. Testing your firewall should include both vulnerability scanning and penetration testing.

7. Once you have finished testing your firewall, it should be ready for the production environment. Always remember to keep a backup of your firewall configuration in a secure place so that the work is not lost in the event of a hardware failure.

8. With your firewall configuration on the production environment, the firewall must be maintained regularly: monitor the firewall logs, keep firmware up to date, perform vulnerability scans, and regularly review firewall rules with security experts. Make sure that you document your process. Be diligent about performing these ongoing tasks to ensure that your firewall continues to protect your network.