Windows Firewall
We recommend that you have an endpoint firewall installed as part of your security model. The firewall should be enabled for “review” or “learning” mode (or the mode specific to the vendor firewall, which allows automatic rule creations), for a short duration inside a known controlled environment. This allows the to generate the necessary rule set based on actual activity. This can then be evaluated (depending on the firewall vendor) and incorporated into a general policy for deployment.
Windows Firewall comes as a standard feature that can be enabled and configured to provide an effective, extra level of defense within a network from outside attack. Known protocols, ports, sources and destinations can be pre-configured within the domain security policy and implemented throughout the network, (see Use Secure Web Ports with a Trusted SSL Certificate).
Non-domain based systems would need to be configured manually. This process could be easily implemented using installation scripts or alternatively the use of a third party endpoint firewall with a central management console could be more efficient.
The additional tools, drivers and services used by a SCADA system can make the configuration more complex to define at the earlier part of the system design.
If a third party endpoint protection is to be used, then it is recommended to disable the windows firewall to prevent any possible conflict.