Description

Ensure no network security group rule allows inbound traffic from 0.0.0.0/0 (any IPv4 address on the internet) to TCP port 3389, which is used for Remote Desktop (RDP) access to Windows instances. Remote administration should come only from trusted IP ranges or through the OCI Bastion service.

Rationale

Port 3389 open to the whole internet is constantly scanned by attackers, who try password guessing and known exploits against RDP. A single weak password or unpatched service can then give an attacker control of the instance. Limiting RDP to trusted networks, or using OCI Bastion instead, removes this exposure while still allowing administrators to connect.

Impact

  • Blocks RDP access from the public internet

  • Reduces brute-force and exploit attempts

  • Administrators must connect from trusted IP ranges or through OCI Bastion

Default Value

By default, a new network security group has no ingress rules.

Pre-Requisites

  • Permission to manage virtual-network-family in the compartment

  • A list of trusted IP ranges that need RDP access, or an OCI Bastion set up

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.

  4. Review the ingress rules and look for any rule with source 0.0.0.0/0 that allows TCP port 3389, or all protocols or all ports.

  5. Repeat for every network security group in each VCN.

  6. If any such rule is found, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.

  4. Find the ingress rule that allows 0.0.0.0/0 to port 3389.

  5. Select Edit on the rule and change the source CIDR to a trusted IP range, or delete the rule.

  6. Save the changes.

  7. Confirm that administrators can still connect from trusted networks or through OCI Bastion.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.

  4. Add back the previous ingress rule (source 0.0.0.0/0, TCP destination port 3389) and save.

Reference