Back to All Checks
High EC2 Regional

EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports

Description

Flags EC2 security groups that allow inbound traffic from 0.0.0.0/0 to the SSH (22) or RDP (3389) remote-administration ports. Public exposure of these ports is the single most common path for unauthenticated lateral movement and brute-force compromise.

Remediation

Remove or scope down the 0.0.0.0/0 ingress rule on each affected security group.

Steps

  1. Open the Amazon EC2 console and choose Security groups.
  2. Select the affected group and choose Edit inbound rules.
  3. Replace 0.0.0.0/0 with a specific CIDR (e.g. corporate VPN) or remove the rule.
  4. Save the changes.
Start Your Free Security Check