# 5.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to Remote Server Administration Ports (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233120-5-2-ensure-no-network-acls-allow-ingress-from-0-0-0-0-0-to-remote-server-administration-ports-automa - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 5](https://support.icompaas.com/support/solutions/folders/62000169192) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** ## **Description:** The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. To minimize exposure, NACLs should not allow unrestricted ingress (0.0.0.0/0) to remote server administration ports, such as: - SSH (Port 22) - RDP (Port 3389) - Other remote administrative ports using: - TCP (Protocol 6) - UDP (Protocol 17) - ALL (-1) protocols ## Rationale: Allowing unrestricted public access to administrative ports (such as SSH on port 22 and RDP on port 3389) significantly increases the attack surface, leading to: - Increased risk of brute force attacks. - Higher chance of unauthorized access. - Potential for resource compromise and data breaches. - Exploitation by automated bots scanning for open ports. By limiting access to specific trusted IP ranges, organizations can reduce security risks and improve compliance. ## Impact: - Failure to restrict NACL rules can lead to unauthorized access attempts from external attackers. - Open administrative ports allow brute-force attacks, malware infiltration, and privilege escalation. - Non-compliance with security policies such as SOC 2, PCI DSS, and CIS Benchmark standards. ## Default Value: By default, AWS does not create explicit allow rules in NACLs. - New VPCs have default deny-all rules for inbound and outbound traffic. - Administrators must manually configure NACL rules for inbound access. ## Pre-Requisites: 1. AWS CLI Installed (for command-line verification and remediation). 2. IAM Permissions Required: - ec2:DescribeNetworkAcls (for auditing). - ec2:DeleteNetworkAclEntry (for remediation). - ec2:ReplaceNetworkAclEntry (for updating rules). 3. Access to AWS Management Console with permissions to modify NACL rules. 4. Security Group Reviews Completed (Security Groups should also block unrestricted access). ## Remediation: ### Test Plan: ## Using AWS Console 1. Login to the AWS VPC Console: [AWS VPC Console](https://console.aws.amazon.com/vpc/home). 2. In the left pane, click Network ACLs. 3. For each Network ACL, perform the following steps: - Select the Network ACL. - Click the Inbound Rules tab. - Ensure no rules exist that: - Have a port range including 22 (SSH) or 3389 (RDP). - Use protocols TCP (6), UDP (17), or ALL (-1). - Have Source 0.0.0.0/0. - Show ALLOW. ## **Implementation Steps: **Using AWS Console 1. Login to the AWS VPC Console: [AWS VPC Console](https://console.aws.amazon.com/vpc/home). ![](https://support.icompaas.com/assets/kb/38558d43e30f091a.png) 2. In the left pane, click Network ACLs. ![](https://support.icompaas.com/assets/kb/7954561b97fd6b78.png) 3. For each non-compliant ACL, follow these steps: - Select the Network ACL. - Click the Inbound Rules tab. - Click Edit inbound rules. ![](https://support.icompaas.com/assets/kb/88cc513f7315241a.png) - Update the Source field to a more restricted IP range (e.g., corporate VPN range). ![](https://support.icompaas.com/assets/kb/d75b04a9c1ea21f4.png) - Alternatively, remove the offending rule by clicking Remove. - Click Save. ![](https://support.icompaas.com/assets/kb/f90b9c29aa59d748.png) ## Backout Plan: If legitimate users are blocked: 1. Re-add ACL rules to allow necessary access: aws ec2 create-network-acl-entry --network-acl-id --rule-number --protocol 6 --port-range From=22,To=22 --cidr-block --rule-action allow --egress false 2. Validate access using SSH or RDP. 3. Update security groups if alternative remote access methods are available. ## References: - [AWS Network ACL Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) - [AWS Security Best Practices](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison) ## CIS Controls Mapping

CIS Control Version

Control ID

Control Description

CIS v7

9.2

Ensure Only Approved Ports, Protocols, and Services Are Running

CIS v7

12.4

Deny Communication over Unauthorized Ports

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.