no security groups allow ingress : iCompaas Support

Profile Applicability: Level 1

Description

Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to port 3389. If security groups allow all traffic on RDP, it may allow to brute force attack into the system and potentially get access to the entire network. So that limits the access list to include known hosts, services, or specific employees only.
We know about RDP it is developed by Microsoft which provides a Graphical User Interface to connect one computer to another computer.

Note: If all IPv4 addresses access your instance using RDP it is unsafe for production environments. We authorize only a specific IP address or range of addresses to access your instance.

Rationale

Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.

Impact

For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to ports 22 and/or 3389 through another security group.

Default Value

The following table describes the default rules for a default security group

Inbound
Type	Protocol	Port Range	Source	Description
All traffic	All	All	Security Group ID (e.g.:- sg-dedc3c97 / default)	For the associated instances inbound traffic allow from network interfaces which are assigned to the same security group.

Outbound
Type	Protocol	Port Range	Destination	Description
All traffic	All	All	0.0.0.0/0	Allow all outbound IPv4

Audit

Perform the following to determine if the account is configured as prescribed:

Log in to the AWS Management Console and go to the VPC dashboard at https://console.aws.amazon.com/vpc/home
In the left navigation pane click on the security group
Select the security group to audit
Click the Inbound Rules tab
See the inbound rules

For Port 3389 if the source is set to 0.0.0.0/0 or::/0 (Anywhere), it means the selected security group allows unrestricted traffic on port 3389, therefore the RDP access the instances which are not secured.

Via CLI:

To describe a security group

aws ec2 describe-security-groups \
  --group-id <give group_id>

To describe security groups that have specific rules (port 3389) and allow from all address

aws ec2 describe-security-groups \
    --filters Name=ip-permission.from-port,Values=3389 \
     Name=ip-permission.to-port,Values=3389
     Name=ip-permission.cidr,Values='0.0.0.0/0' \
     --query "SecuriytGroups[*].[GroupName]" \

Remediation

Pre-Requisite

Identify AWS resources that exist within the default security group.
Before implementation steps create a set of least privileged security groups for those resources.
Place the resources in those security groups
Remove the resources noted in #1 from the default security group State

Implementation Steps

Perform the following to implement the prescribed state:

Log in to the AWS Management Console at https://console.aws.amazon.com/vpc/home
In the left navigation pane, click Security Groups
Choose the Security Group to configure the rules for RDP (port 3389)
Click the Inbound Rules tab for the selected security groups
Click on Edit inbound rules button
For type RDP Port range 3389 protocol TCP and in the source column remove 0.0.0.0/0 or Anywhere give the least privilege or select my IP
Click on the Save rules button

Via CLI

1. List all security groups with an ingress rule of 0.0.0.0/0

aws ec2 describe-security-groups \
--filters Name=ip-permission.cidr,Values='0.0.0.0/0' \
--query "SecurityGroups[*].{Name:GroupName,ID:GroupId}”

2. Remove the rule

aws ec2 revoke-security-group-ingress \
--group-id <value> --protocol <protocol> \
--port 3389 --cidr 0.0.0.0/0

3. Add restrictive ingress rule to the selected security group

aws ec2 authorize-security-group-ingress \
--region <region> --group-name <group_name> \
--protocol <protocol> --port 3389 --cidr <cidr_block>

Backout Plan

If you have any problem after the implementation steps then follow the implementation step 1-5 and then configure to allow the IPs in the source column and click on save rule the button.