The network team has well-established procedures to follow for creating new rules on the firewall. This includes having approval from a manager prior…

The fundamental principle of change management and security configuration management is to maintain a system in a known, authorized state. An unapproved firewall rule represents an unauthorized change, introducing an unknown and unacceptable level of risk. It could be a misconfiguration creating a vulnerability or a malicious backdoor. The immediate priority is to mitigate this risk by reverting the system to its last approved configuration. This action, known as a rollback, restores the integrity of the security posture and enforces the established procedures. Any legitimate business need for the rule must then be addressed through the proper, documented approval process, which may include an emergency change request if necessary.

A. Documenting the reason is a necessary follow-up action for process improvement but does not address the immediate security risk of the unauthorized rule.

B. Monitoring is a passive defense; it will only alert you to an exploit after it happens, rather than preventing it by removing the unauthorized rule.

C. This option prioritizes a potential, unverified business need over established security policy, accepting the risk of an unvetted and potentially malicious change.

1. NIST Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations. The Configuration Management (CM) control family

specifically CM-3 "Configuration Change Control

" mandates that organizations "approve or disapprove configuration change requests to the system." An unapproved change violates this control

and standard incident response is to return to the last known-good baseline.

2. NIST Special Publication 800-128

Guide for Security-Focused Configuration Management of Information Systems. Section 3.3.3

"Monitoring and Managing the Security Configuration

" states: "When unauthorized configuration changes are detected

automated mechanisms can be used to either alert security personnel or to revert the changes to a previously authorized configuration." This directly supports the action of rolling back the change.

3. Carnegie Mellon University

Software Engineering Institute

The CERT Guide to System and Network Security Practices. Chapter 16

"Respond to Incidents

" outlines the need to contain incidents. An unauthorized change is a security incident. Containment often involves "disconnecting the affected system from the network or restoring the system to a known-good state

" which aligns with rolling back the unauthorized firewall rule. (ISBN: 978-0321718833

Page 391).