NIST SP 800-215 Guide to a Secure Enterprise Network Landscape 3.2: Deploy firewalls with the feature set the landscape needs, at the edge, inside the data centre and on devices

What does 3.2 require?

Firewalls are chosen and placed for their enlarged functions: packet filtering and address translation, stateful inspection, deep packet inspection of payloads for exfiltration, content violations and malware, threat detection across packets and sessions with feeds to security information and event management, logging and auditing, granular access control, open APIs for integration, and policy composition so that consistent policies reach users on premises and in private and public clouds. Edge firewalls protect the perimeter, data centre firewalls segment internal traffic to stop lateral movement, device firewalls guard endpoints, and web application firewalls with advanced URL filtering protect web applications against injection, cross-site scripting and distributed denial of service.