9.2: Ensure Only Approved Ports, Protocols, and Services Are Running

Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.

Asset Type	Security Function	Implementation Groups
Devices	Protect	2, 3

Dependencies

• Sub-control 1.4: Maintain Detailed Asset Inventory

• Sub-control 1.5: Maintain Asset Inventory Information

Inputs

1. List of authorized ports with validated business need

2. List of authorized protocols with validated business need

3. List of authorized services with validated business need

4. List of endpoints

Operations

1. For each endpoint perform the following to build sets of information:

   1. Scan for open ports

   2. For each open port

      1. Test protocol running on that port

   3. Enumerate installed services

2. Enumerate discovered ports

3. Enumerate discovered services

4. Determine set of unauthorized ports

5. Determine set of unauthorized services

Measures

• M1 = Set of open ports

• M2 = Set of unauthorized ports

• M3 = Set of discovered services

• M4 = Set of unauthorized services

• M5 = Set of unexpected protocols discovered on open ports

Metrics

Ports

Metric	Ratio of unauthorized ports to open ports
Calculation	M2 / M1

Services

Metric	Ratio of unauthorized services to discovered services
Calculation	M4 / M3

Unexpected Protocols

Metric	Ratio of unexpected protocols discovered on open ports to total number of open ports
Calculation	M5 / M1