Detection of Prohibited Network Traffic Permitted by Firewall Policy

This detection focuses on identifying security policy violations where prohibited network traffic is allowed by a Cisco Secure Firewall. By cross-referencing firewall connection events against a defined lookup table of restricted ports and transport protocols, SOC teams can monitor for the use of insecure legacy protocols like FTP (ports 20, 21) or Telnet (port 23). This capability is critical for identifying potential network misconfigurations, policy bypasses, or the use of unauthorized channels for data exfiltration and command-and-control communication. Since these protocols often lack encryption, their presence in an enterprise environment represents a significant security risk, as they may be leveraged by attackers for lateral movement or to exfiltrate sensitive data.

Impact

Successful exploitation of these communication channels can lead to unauthorized data access, credential theft due to plaintext transmission, or the establishment of persistent command-and-control backdoors. Organizations relying on prohibited protocols face increased risks of data breaches and compromised internal network integrity.

Recommendation

Prioritize the implementation of this detection by integrating Cisco Secure Firewall logs into the environment. Tune the "interesting_ports_lookup" table to match internal security policies, as legacy systems may require these protocols for legitimate operations. Investigate all alerts generated by this logic to identify if traffic is originating from compromised endpoints or indicates an unauthorized shadow IT deployment.