Listen to this Post
Introduction:
A recent disclosure by a healthcare CISO has revealed a shocking practice during software updates: the complete disabling of local host firewalls. This procedure, allegedly implemented by a major medical software vendor, highlights a critical failure in secure development and deployment lifecycle management, turning essential security controls into temporary obstacles rather than protective layers.
Learning Objectives:
- Understand the severe security implications of disabling host-based firewalls during maintenance
- Learn how to implement proper, temporary firewall rules instead of complete disablement
- Master auditing techniques to detect and prevent such dangerous practices in your environment
You Should Know:
1. The Dangerous Update Pattern Exposed
The vendor’s script followed this pattern:
DANGEROUS PRACTICE - DO NOT USE systemctl stop firewalld Or on Windows systems: netsh advfirewall set allprofiles state off
Step-by-step guide: This approach completely disables the host firewall, leaving the system exposed during the update process. Instead of stopping the entire firewall service, security professionals should create temporary rules that allow specific update traffic while maintaining other protections.
2. Proper Temporary Firewall Rules for Updates
Linux - Allow specific update service temporarily firewall-cmd --add-service=https --timeout=300 firewall-cmd --add-port=8080/tcp --timeout=300 Windows equivalent using PowerShell New-NetFirewallRule -DisplayName "TempUpdate" -Direction Inbound -Protocol TCP -LocalPort 443,8080 -Action Allow -Enabled True Start-Sleep -Seconds 300 Remove-NetFirewallRule -DisplayName "TempUpdate"
Step-by-step guide: These commands create temporary exceptions that automatically expire, maintaining security while allowing necessary update traffic. The Linux commands use built-in timeout functionality, while the Windows PowerShell approach includes automatic rule removal after the update window.
3. Auditing Firewall State Changes
Linux audit rule to detect firewall disablement echo "-w /usr/bin/firewall-cmd -p x -k firewall_change" >> /etc/audit/rules.d/firewall-monitoring.rules echo "-w /usr/bin/systemctl -p x -k service_management" >> /etc/audit/rules.d/firewall-monitoring.rules auditctl -R /etc/audit/rules.d/firewall-monitoring.rules Windows equivalent using native auditing auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
Step-by-step guide: Implement continuous monitoring of firewall state changes. The Linux audit rules track any execution of firewall management commands, while the Windows command enables auditing for firewall modifications. Both should be integrated with your SIEM for alerting.
4. Network Segmentation as Defense-in-Depth
Cisco IOS example - Restrict update server access access-list 150 permit tcp host 10.1.1.100 host 192.168.1.50 eq 443 access-list 150 permit tcp host 10.1.1.100 host 192.168.1.50 eq 8080 access-list 150 deny ip any any log AWS Security Group for update management aws ec2 authorize-security-group-ingress \ --group-id sg-update123 \ --protocol tcp \ --port 443 \ --source-ip 203.0.113.100/32
Step-by-step guide: Implement network-level controls that restrict update servers to specific source IPs and required ports only. This creates multiple layers of defense, ensuring that even if host firewalls are compromised, network segmentation provides protection.
5. Configuration Management Enforcement
Ansible playbook to ensure firewall remains enabled - name: Ensure firewall is enabled and running hosts: all tasks: - name: Enable and start firewalld ansible.builtin.systemd: name: firewalld state: started enabled: yes <ul> <li>name: Ensure default zone is set ansible.builtin.command: firewall-cmd --set-default-zone=public</p></li> <li><p>name: Critical - reject any direct firewall disablement lineinfile: path: /etc/sudoers.d/firewall-protection line: 'ALL !NETWORK_ADMINS = /usr/bin/systemctl stop firewalld, /usr/bin/systemctl disable firewalld' validate: '/usr/sbin/visudo -cf %s'
Step-by-step guide: Use configuration management tools to enforce firewall policies and prevent unauthorized changes. This Ansible playbook ensures the firewall service is always running and uses sudoers restrictions to prevent unauthorized disablement.
6. Container Security Alternatives
Dockerfile example - Application-specific firewall FROM alpine:latest RUN apk add --no-cache iptables Create application-specific iptables rules RUN iptables -A INPUT -p tcp --dport 8080 -j ACCEPT && \ iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT && \ iptables -A INPUT -j DROP Instead of disabling host firewall, use container networking docker network create --driver bridge update-network docker run --network update-network --cap-add=NET_ADMIN my-update-container
Step-by-step guide: For modern applications, use container-specific networking and security controls rather than disabling host firewalls. This approach isolates update processes while maintaining overall system security.
7. Incident Response Detection
Script to detect firewall disablement events
!/bin/bash
Monitor for firewall state changes
journalctl -u firewalld --since "1 hour ago" | grep -E "(stopped|disabled)"
Check current firewall state
firewall-cmd --state | grep -q "running" || echo "ALERT: Firewall not running"
Windows PowerShell detection script
Get-Service | Where-Object {$<em>.Name -like "firewall" -and $</em>.Status -ne "Running"}
Step-by-step guide: Implement continuous monitoring scripts that alert security teams when firewall services are stopped. These scripts can be integrated into existing monitoring solutions and should trigger immediate incident response procedures.
What Undercode Say:
- Vendor Security Practices Must Evolve: Software vendors can no longer treat security controls as obstacles to be circumvented during updates. This represents a fundamental misunderstanding of modern security requirements.
- Healthcare Sector Particularly Vulnerable: Medical environments often prioritize availability over security, creating dangerous precedents that can be exploited by threat actors.
The discovery of this practice in healthcare software is particularly alarming given the sector’s sensitivity. Medical devices and healthcare systems are prime targets for ransomware attacks, and disabling fundamental security controls during updates creates predictable attack windows. This isn’t just poor practice—it’s a systemic failure that reflects the continued separation between development teams and security operations. Organizations must establish strict change control procedures that explicitly prohibit such dangerous workarounds and implement technical controls to prevent them entirely.
Prediction:
This incident foreshadows increased regulatory scrutiny of software vendor practices, particularly in critical infrastructure sectors. We predict mandatory certification requirements for update mechanisms and increased liability for vendors who implement insecure procedures. Within two years, expect to see industry standards specifically addressing secure update methodologies, with third-party audits becoming a prerequisite for software procurement in regulated industries.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ines Wallon – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
