Scenario S-003 - Exploitation of firewall misconfiguration
| Element | Description |
|---|---|
| Scenario ID | S-003 |
| Target asset | OPNsense Firewall controlling network traffic between external and internal zones |
| Threat source | External attacker |
| Attack vector | Misconfigured firewall rule or unintended exposure of internal service |
| Potential impact | Unauthorized access to internal services enabling reconnaissance or lateral movement within the network |
| Likelihood | 🟨 Medium - firewall rule misconfigurations are common operational errors in infrastructure environments |
| Impact rating | 🟧 Major - exposure of internal services may allow attackers to access sensitive systems or exploit additional vulnerabilities |
| Risk rating | 🟥 High |
Mitigation:
- Apply strict firewall rule management and change review procedures.
- Use deny-by-default policy for inbound and inter-zone traffic.
- Regularly audit firewall rules and exposed ports.
- Implement network segmentation between DMZ, infrastructure, and internal services.
- Monitor firewall logs and alert on unusual connection attempts.
Owners:
- Ops - firewall configuration, rule maintenance, infrastructure networking.
- Sec - rule auditing, monitoring policies, detection rules.
References:
- ISO 27001 - Control 8.20 Network security.
- ISO 27001 - Control 8.16 Monitoring activities.
- ISO 27001 - Control 8.22 Segregation of networks.
- NIST CSF - PR.AC Access Control.
- NIST CSF - PR.PT Protective Technology.
- NIST CSF - DE.CM Continuous Monitoring.
- EBIOS RM - Threat scenarios involving misconfigured network devices exposing internal resources.
Response actions:
- Containment - Immediately disable or correct the misconfigured firewall rule exposing the internal service.
- Eradication - Review firewall configuration history and identify the source of the misconfiguration.
- Recovery - Validate firewall rules, perform network scan to ensure no unintended exposure remains.
- Post-incident - Update firewall change management procedures and strengthen configuration review practices.