# 5.3 Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000234274-5-3-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-to-remote-server-administration-ports-aut - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description: Security groups in AWS control the flow of network traffic to and from resources, including EC2 instances. By default, security groups might allow ingress from 0.0.0.0/0 to remote server administration ports (e.g., SSH on port 22, RDP on port 3389). Allowing ingress from 0.0.0.0/0 effectively opens the administration ports to the entire internet, which poses a significant security risk. It is essential to ensure that no security groups allow unrestricted ingress from 0.0.0.0/0 to remote administration ports. This practice minimizes exposure to brute-force and other types of attacks targeting the server administration interfaces. #### Rationale: Blocking ingress from 0.0.0.0/0 to server administration ports offers several benefits: - Security: Prevents unauthorized access to server administration ports from the entire internet, limiting the attack surface. - Compliance: Meets security requirements for restricting access to critical services such as SSH and RDP, which need to be tightly controlled. - Minimized attack surface: By blocking public access to remote administration ports, the network is protected from potential brute-force attacks or unauthorized attempts to gain administrative access. - Auditability: Ensures that access to critical resources is properly monitored and restricted, providing clear visibility into who has access to these sensitive ports. Without this restriction, public-facing EC2 instances could be exposed to the internet, allowing malicious actors to exploit vulnerabilities in remote administration services. #### Impact: Failure to block ingress from 0.0.0.0/0 to remote server administration ports can result in: - Unauthorized access: Open access to server administration ports can be exploited by attackers for unauthorized access, leading to data breaches or system compromises. - Increased risk of attacks: Allowing unrestricted access increases the likelihood of successful brute-force attacks or exploitation of known vulnerabilities. - Non-compliance: Violates security best practices and compliance standards requiring restricted access to remote administration ports. Blocking ingress from 0.0.0.0/0 ensures that only authorized users or systems have access to critical administration ports. #### Default Value: By default, AWS security groups may allow ingress from 0.0.0.0/0 to ports like SSH (port 22) and RDP (port 3389) if not explicitly configured otherwise. This default setting should be modified to restrict access. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - ec2:DescribeSecurityGroups - ec2:RevokeSecurityGroupIngress - ec2:AuthorizeSecurityGroupIngress - Access to EC2 instance security groups to modify ingress rules #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [EC2 Console](https://console.aws.amazon.com/ec2/). 2. In the Security Groups section, review the inbound rules for each security group. 3. Identify any security groups that allow ingress from 0.0.0.0/0 to ports like SSH (22) or RDP (3389). 4. Modify the Inbound rules to block access from 0.0.0.0/0 to these ports and ensure that access is restricted to trusted IP addresses. Using AWS CLI: aws ec2 describe-security-groups --query "SecurityGroups\[\].\[GroupName, IpPermissions\]" --output table To check if any security group allows ingress from 0.0.0.0/0: aws ec2 describe-security-groups --query "SecurityGroups\[?IpPermissions\[?IpRanges\[?CidrIp=='0.0.0.0/0'\]\]\].GroupName" --output table ##### Implementation Plan: Using AWS Console: 1. Modify security group to block ingress from 0.0.0.0/0: - Go to the [EC2 Console](https://console.aws.amazon.com/ec2/). - In the Security Groups section, find the security group that allows ingress from 0.0.0.0/0 on remote administration ports. - Modify the Inbound rules to remove any rules allowing 0.0.0.0/0 for ports like SSH (22) or RDP (3389). - If necessary, add more restrictive rules to allow access only from specific IP addresses or address ranges. 2. Verify the changes: - After modifying the rules, ensure that the security group no longer allows ingress from 0.0.0.0/0 to sensitive administration ports. Using AWS CLI: 1. Revoke ingress from 0.0.0.0/0 on remote server administration ports: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 22 --cidr 0.0.0.0/0 aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0 2. Add more restrictive ingress rules: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 22 --cidr /32 aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 3389 --cidr /32 3. Verify that no security groups allow ingress from 0.0.0.0/0: aws ec2 describe-security-groups --query "SecurityGroups\[?IpPermissions\[?IpRanges\[?CidrIp=='0.0.0.0/0'\]\]\].GroupName" --output table #### Backout Plan: Using AWS Console: 1. If restricting ingress causes connectivity issues: - Go to the [EC2 Console](https://console.aws.amazon.com/ec2/). - Revert the security group to allow ingress from 0.0.0.0/0 on remote administration ports (SSH or RDP) temporarily if needed for troubleshooting. - Modify the rules to allow more restrictive access as necessary. 2. Review the security group settings to ensure only the necessary IP addresses or ranges have access to the remote administration ports. Using AWS CLI: 1. Revert ingress rules temporarily if remote access issues occur: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 22 --cidr 0.0.0.0/0 aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0 2. Revert back to restrictive access rules once issues are resolved: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 22 --cidr 0.0.0.0/0 aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 3389 --cidr 0.0.0.0/0 #### References: - [AWS VPC Security Group Documentation ](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) - [AWS CLI Command Reference for EC2 ](https://docs.aws.amazon.com/cli/latest/reference/ec2/) - [AWS Security Best Practices ](https://aws.amazon.com/security/) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.9

Perform Continuous Security Monitoring and Incident Detection

CIS v7

6.3

Monitor Security Configurations for Compliance

CIS v7

5.2

Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.