Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Defense Impairment
Platforms: Windows, Linux, macOS, IaaS, Network Devices, ESXi
Relationship: defensive coverage for the active Windows host-firewall sub-technique
Open the official ATT&CK object ↗Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
What it means
Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.
Why it matters
Network firewalls cannot see every path to a host; local enforcement provides a final boundary that travels with the workload and can distinguish services by role.
Practical focus
- Define the network flows each host role must initiate, receive, or forward and the security outcome it must support
- Apply default-deny policy, service-based rules, state tracking, and controlled rule changes through documented, reviewable configuration
- Verify effective runtime and persistent rules, connection tests, and denied traffic after changes and on a scheduled basis
- Plan for a rule change blocking administration or an exception remaining after troubleshooting, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a rule change blocking administration or an exception remaining after troubleshooting as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: