Default Rules for High Security Device Groups

Overview

Customers with devices that handle Protection Level 4 (P4) data according to the Data and IT Resource Classification Standard are placed in special high-security device groups. These groups contain default rules that ensure mandatory vulnerability scanning occurs and that known bad actors are blocked automatically.

High Security Device Group Names

The high-security rules are applied across the following firewall environments:

• ewdc-high-security (Earl Warren Data Center firewall)
• campus-high-security (Campus/Users firewalls)
• sdsc-high-security (San Diego disaster recovery site)
• sut-mdc-dc-high-security (Sutardja Dai Mini Data Center)

Default Security Rules

The following rules are automatically enforced for high-security device groups:

1. Vulnerability Scanning: Allows access from the ISO vulnerability scanners.
2. IP Blocking: Blocks traffic to and from "bad" IP addresses as determined by the firewall vendor and ISO threat feeds.
3. Threat Prevention: Blocks traffic to known command-and-control, malware, phishing, and ransomware IP addresses, as well as sites known to be targeting campus users.
4. System Updates: Allows outbound traffic for OS updates for both Apple and Microsoft products.

Registration and Responsibility

If a vsys in one of the high-security device groups has networks or zones without P4 data, it is the responsibility of the departmental administrator to put their own blocking policies in place for those areas. Administrators can utilize Shared Objects, such as Address Groups and URL Lists, to accomplish this.

If you have questions about ensuring your systems are properly registered, please see: KB0012137 - What is Socreg?