---
# System prepended metadata

title: Firewall

---

# Firewall
## Policy compliance
**Put in contract that you must follow or get out of here.**
Making small changes noted automatically, bullying important people if something isnt reverted. 
**Important people get notifications every time something large is changed - Tom scott talk google getting deleted internally password=true, (if you dont know dont say it.)**
Rewards for reading and following.
Splash page when going somewhere where you need to read the policy.
**Gamification for training. Making there be below items.**
Competition for who does the quiz the best if you win *BONUS*.
**Formal training for new users, part of their induction**
**Lab training during interview phase. To prevent people from faking being good at a thing.**
**Provide access only once training complete, training expires after a certain time.**
### Example AUP
https://www.sans.org/security-resources/policies/general/pdf/acceptable-use-policy

## Leave or remove any any rules.
Taking time to choose which ports to use
Breaking applications
Have to test
If things break then users are annoyed and bad PR
^^ How long does it take to fix it if something breaks ^^
Update recruitment process
Make a risk analysis 
Change control

## Ensure future changes are compliant with policy
### One person cannot break everything even high person.
**Firewall logging**
NTP keeping time
**Pipeline all the things.**
**Hierarchy of approval**
**Multiple levels of testing, internal alpha -> internal beta -> canary(external alpha) -> external beta -> Public Build(Stable)**
Scream test
Make it someone elses problem
*Standardisation of assets, but not too much, one problem for hardware doesnt want to affect entire building.*
Network intrusion detection
Scenario planning/War games - Include edge cases
Network monitoring
**Make sure people are the correct people**
**People can't mess with important things, windows defender etc.**

CCTV on hardware to watch if external people use the things.
Worker background checks.

Run a second external audit
- Professional pen testing
- Vulnerability scanning

## One person cannot break everything even high person.

## Other
Backups
**3 points of backup, Atleast Two places in atleast two mediums.**
**Failover hardware ready to instantly step in is poop hits fan.**
Potentially develop a new network and switch with production
Schedule downtime
**Increase logging out of hours, this is where stuff goes wrong.**

Check your entire network.
- Endpoint protecton
- Antivirus
- Passwords

Deterrents
Who can actually access our devices?
Check what is in the hardware
Balance changing passwords with security

Two audits, real and fake.

CCTV on hardware to watch if external people use the things.
Worker background checks.

