Description

Ensure the default security list of every VCN does not allow any inbound traffic except ICMP from within the VCN's own CIDR block. Traffic that resources need should be allowed through dedicated security lists or network security groups, rather than through the default list that applies to every new subnet.

Rationale

The default security list is automatically attached to subnets that are created without another list, and by default it allows SSH from anywhere. Resources placed in these subnets can then be exposed to the internet without anyone noticing. Restricting the default list to ICMP within the VCN makes new subnets safe by default.

Impact

  • New subnets are not exposed by default rules

  • Removes the default SSH-from-anywhere rule

  • Required traffic must be allowed through dedicated rules

Default Value

By default, the default security list allows TCP port 22 from 0.0.0.0/0, ICMP type 3 code 4 from 0.0.0.0/0, and ICMP type 3 from the VCN CIDR, and allows all egress traffic.

Pre-Requisites

  • Permission to manage virtual-network-family in the compartment

  • Dedicated security lists or network security groups for traffic that resources need

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab and select the security list named Default Security List for <VCN name>.

  4. Review the ingress rules and verify that the only rules allow ICMP from the VCN's CIDR block.

  5. If any other ingress rule exists, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Create a dedicated security list or network security group for any traffic your resources need, and attach it to the subnets or VNICs.

  4. Open the default security list for the VCN.

  5. Delete every ingress rule except ICMP from the VCN CIDR block, and save.

  6. Confirm that applications still work through the dedicated rules.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the default security list and add back the removed ingress rules, then save.

Reference