NCSC Control Pillar 1 – Firewalls & Network Gateways

1.1 Boundary Protection Requirements

• ✓ Strict Default-Deny Rule: All unapproved inbound connection requests must be dropped automatically at the boundary.
• ✓ Block Administrative Ports: RDP (Port 3389) and SSH (Port 22) must never be directly exposed to the public internet.
• ✓ Zero-Trust Remote Access: Enforce encrypted VPN with MFA or ZTNA for all remote management tasks.

Sample Edge Hardening Script (Linux UFW)

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 80/tcp comment 'HTTP Web Traffic'
sudo ufw allow 443/tcp comment 'HTTPS Web Traffic'
sudo ufw enable