Security Groups Rule: Restrict Access to High-Risk Ports
This rule ensures security groups do not permit unrestricted access to high-risk ports.
| Rule | Security groups should not allow unrestricted access to ports with high risk |
| Framework | NIST 800-171 Revision 2 |
| Severity | ✔ High |
Rule Description:
This rule ensures that security groups in the network configuration do not have unrestricted access to ports with high risk as identified by NIST 800-171 Revision 2. By implementing this rule, organizations can reduce the exposure to potential security threats and comply with the security guidelines set by NIST.
Troubleshooting Steps:
If a security group is found to have unrestricted access to ports with high risk, follow these steps to troubleshoot and remediate the issue:
- 1.
Identify the affected security group(s): Determine the security group(s) that have unrestricted access to ports with high risk as identified by NIST 800-171 Revision 2.
- 2.
Review the current rules: Analyze the existing rules within the security group(s) to identify any rules that allow unrestricted access to high-risk ports.
- 3.
Determine the associated resources: Identify the resources that are associated with the security group(s) in question. This can include instances, load balancers, or any other AWS resources that rely on the security group for access control.
- 4.
Assess the potential impact: Evaluate the potential impact of modifying the rules to restrict access to high-risk ports. Ensure that any necessary access for legitimate business needs is preserved.
- 5.
Modify the security group rules: Update the security group rules to deny unrestricted access to ports with high risk. Apply specific IP ranges or CIDR blocks that are allowed access, considering the least privilege principle.
- 6.
Test the changes: Validate that the updated security group rules are functioning as intended by verifying connectivity and access to the required ports. Test from both inside and outside of the network environment.
- 7.
Monitor for compliance: Regularly monitor the security group configurations to ensure ongoing compliance with the rule. Establish a process for reviewing and approving any changes to the security group rules to prevent future unauthorized access.
Necessary Codes:
No specific codes are required for this rule. However, the following AWS Command Line Interface (CLI) commands can be used to modify security group rules:
- 1.Describe security groups:
aws ec2 describe-security-groups --group-ids <security-group-id>
- 1.Modify security group rules:
aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol <protocol> --port <port-range> --source <ip-range>
- 1.Revoke security group rules:
aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol <protocol> --port <port-range> --source <ip-range>
Step-by-Step Guide for Remediation:
Follow these steps to remediate the security group's unrestricted access to high-risk ports:
- 1.
Identify the security group: Use the AWS Management Console or AWS CLI to identify the security group that needs modification. Note down the security group ID.
- 2.
Review the current rules: Obtain the list of security group rules for the identified security group using the
CLI command.describe-security-groups - 3.
Identify unrestricted access rules: Look for any rules that allow unrestricted access to high-risk ports as defined by NIST 800-171 Revision 2. Take note of the affected rules.
- 4.
Determine legitimate access requirements: Identify any specific IP ranges or CIDR blocks that should be allowed access to the high-risk ports. Determine the source of legitimate access based on your organization's requirements.
- 5.
Modify the security group rules: Use the
CLI command to modify the security group rules. Revoke or modify the affected rules to restrict access and allow only the authorized IP ranges or CIDR blocks.authorize-security-group-ingress - 6.
Test the changes: Validate the modified security group rules by attempting to access the high-risk ports from both inside and outside the network environment. Ensure that access is only granted to the intended IP ranges or CIDR blocks.
- 7.
Monitor compliance: Regularly monitor the security group configurations to ensure ongoing compliance with the rule. Create a process to review and approve any future changes to the security group rules to prevent unauthorized access.
By following these steps, you can effectively remediate the security group configuration to disallow unrestricted access to ports with high risk as defined by NIST 800-171 Revision 2.