lacework-global-68
Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports (Automated)
Profile Applicability
• Level 1
Description
Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. Best practices recommend that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port 22
and Remote Desktop Protocol (RDP) to port 3389
, using either the Tag Distribution Protocol (TDP) (6), User Datagram Protocol (UDP) (17) or ALL (-1) protocols.
Rationale
Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.
Impact
When updating an existing environment, ensure that administrators have access to remote server administration ports through another mechanism before removing access by deleting the 0.0.0.0/0 inbound rule.
Audit
Perform the following to determine if the account is configured as prescribed:
- Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home
- In the left pane, click
Security Groups
- For each security group, perform the following:
- Select the security group
- Click the
Inbound Rules
tab - Ensure no rule exists that has a port range that includes port
22
,3389
, using the protocols TDP (6), UDP (17) or ALL (-1) or other remote server administration ports for your environment and has aSource
of0.0.0.0/0
A Port value of ALL
or a port range such as 0-1024
are inclusive of port 22
, 3389
, and other remote server administration ports.
Remediation
Perform the following to implement the prescribed state:
- Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home.
- In the left pane, click
Security Groups
. - For each security group, perform the following:
- Select the security group
- Click the
Inbound Rules
tab - Click the
Edit inbound rules
button - Identify the rules to edit or remove
- Either A) update the Source field to a range other than 0.0.0.0/0, or, B) Click
Delete
to remove the offending inbound rule - Click
Save rules