Control: 2.2 Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389

Description

Security lists provide stateful or stateless filtering of ingress/egress network traffic to OCI resources on a subnet level. It is recommended that no security group allows unrestricted ingress access to port 3389.

Removing unfettered connectivity to remote console services, such as Remote Desktop Protocol (RDP), reduces a server's exposure to risk.

Remediation

From Console

1. Follow the audit procedure above.
2. For each security list in the returned results, click the security list name.
3. Either edit the ingress rule to be more restrictive, delete the ingress rule or click on the VCN and terminate the security list as appropriate.

From CLI

1. Follow the audit procedure.
2. For each of the security lists identified, execute the following command:

oci network security-list get --security-list-id <security list id>

3. Then either:

• Update the security list, copy the ingress-security-rules element from the JSON returned by the above get call, edit it appropriately and use it in the following command

oci network security-list update --security-list-id <security-list-id> --ingress-security-rules '<ingress security rules JSON>'

or

• Delete the security list

oci network security-list delete --security-list-id <security list id>