An outside vulnerability assessment reveals that users have been routinely accessing Gmail from work for over a year, a clear violation of this organization’s security policy. The users report “it just started working one day”. Later, a network administrator admits he meant to unblock Gmail for just his own IP address, but he made a mistake in the firewall rule. Which security control failed?

The core of the issue is a misconfigured firewall rule. Firewalls are a fundamental technical mechanism for enforcing network access control policies. Their purpose is to permit or deny traffic between networks based on a defined rule set, thereby controlling access to resources. In this scenario, the firewall was intended to block access to Gmail for most users, but due to an error, it granted broad, unauthorized access. This represents a direct failure of the access control function to enforce the organization's security policy.

B. Authentication: This control verifies a user's identity (e.g., with a password). The problem was not that users were improperly identified, but what they could access once on the network.
C. Auditing: This control involves reviewing logs and records. The vulnerability assessment is a form of auditing that successfully detected the control failure; the audit process itself did not fail.
D. Rights management: This typically refers to more granular controls over specific data or application features (e.g., read/write/print permissions), not broad network-level access like a firewall provides.

1. NIST Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Section: Access Control (AC) Family.

Details: The AC family of controls is defined to "limit information system access to authorized users...and to the types of transactions and functions that authorized users are permitted to exercise." Control AC-4, "Information Flow Enforcement," specifically describes the use of policy enforcement mechanisms (like firewalls) at managed interfaces to control the flow of information. The scenario describes a failure in this exact function.

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.

Chapter 20, "Firewalls and Intrusion Prevention Systems," Section 20.1 "The Need for Firewalls."

Details: The text states, "In essence, a firewall is an access control device." It clarifies that a firewall's primary role is to act as a filter to enforce the access control policy of the organization between a trusted internal network and an untrusted external network.

3. MIT OpenCourseWare. (2014). 6.857 Network & Computer Security.

Lecture 15: Network Security & Firewalls.

Details: The course materials describe firewalls as a key component for enforcing a security perimeter. They function by inspecting network packets and using rules based on IP addresses and port numbers to block or permit traffic, which is a direct implementation of a network access control policy. A misconfiguration, as described in the question, is a failure of this policy enforcement.