High
EC2
Regional
Security groups should only allow unrestricted incoming traffic for authorized ports
CISISO 27001
Description
Checks whether security groups only allow unrestricted incoming traffic for authorized ports.
Remediation
To comply with this control, modify security groups to ensure only authorized ports allow unrestricted incoming traffic.
Steps
- Sign in to the AWS Management Console and open the EC2 console at https://console.aws.amazon.com/ec2/.
- In the navigation pane, click on 'Security Groups'.
- Select the security group you want to modify.
- In the 'Inbound rules' tab, review the rules to identify any that allow unrestricted incoming traffic (0.0.0.0/0) on unauthorized ports.
- For each rule that does not comply, click on 'Edit inbound rules'.
- Modify the source to restrict access to authorized ports only, or delete the rule if it is not required.
- Click on 'Save rules' to apply the changes.
- Verify that the security group now only allows unrestricted incoming traffic for authorized ports.
Compliance
CISISO 27001