Which of the following rules appearing in an Internet firewall policy is inappropriate?

The fundamental purpose of a firewall is to enforce an access control policy between networks, operating on a principle of least privilege. A rule that allows all inbound and outbound services transparently negates the firewall's security function, effectively reducing it to a simple router. This configuration would fail to inspect, filter, or block potentially malicious traffic, leaving the internal network completely exposed to external threats. A proper firewall policy should be restrictive, explicitly defining what traffic is permitted (default-deny) rather than permitting all traffic by default.

A. Disabling source routing is a standard security best practice. Attackers can abuse source routing to bypass firewall rules and other network security controls, making its disablement an appropriate and necessary policy.

C. This describes a "fail-secure" or "fail-closed" state. It is a critical security design principle that ensures if a security control fails, it defaults to its most secure posture (denying all traffic) to prevent an unprotected state.

D. This is a crucial anti-spoofing rule. Traffic arriving on an external interface with a source address from the internal network is illegitimate and a clear indicator of an IP spoofing attack, which must be blocked.

1. National Institute of Standards and Technology (NIST) Special Publication 800-41 Rev. 1

Guidelines on Firewalls and Firewall Policy.

Section 4.2.2

"Service Policy" (Page 24): This section explicitly contrasts a "default-deny" policy (more secure) with a "default-permit" policy. The rule in option B represents an extreme and insecure "default-permit" stance

which the document advises against. It states

"The primary disadvantage of the default-permit policy is that it can allow unknown and unmonitored services to be used by attackers..."

Section 4.2.4

"Packet Filtering" (Page 26): This section recommends policies that directly support options A and D. It states

"Filter packets with internal source addresses that are coming from the outside" (supporting option D) and "Disable source routing" (supporting option A).

2. Internet Engineering Task Force (IETF) RFC 2827 / BCP 38

Network Ingress Filtering.

Abstract & Section 1 (Page 1): This document describes the best current practice of filtering traffic at the network edge to ensure that incoming packets have a source IP address that is valid for the network they are coming from. This directly supports the anti-spoofing rule described in option D.

3. National Institute of Standards and Technology (NIST) Special Publication 800-53 Rev. 5

Security and Privacy Controls for Information Systems and Organizations.

Control SC-24

"Fail-Safe Procedures" (Page 298): This control family discusses the requirement for systems to transition to a secure state upon failure. The description for a fail-secure state aligns perfectly with option C

ensuring the "system prevents a security compromise in the event of a failure."

4. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. https://doi.org/10.1109/PROC.1975.9939

Section I.A.3

"Fail-safe defaults" (Page 1281): This foundational paper in computer security establishes the principle of fail-safe defaults

which is the basis for option C. It states

"The default situation is lack of access

and the protection scheme identifies conditions under which access is permitted." This principle applies directly to firewall failure states.