Control: 2.5 Ensure the default security list of every VCN restricts all traffic except ICMP
Description
A default security list is created when a Virtual Cloud Network (VCN) is created. Security lists provide stateful filtering of ingress and egress network traffic to OCI resources. It is recommended no security list allows unrestricted ingress access to resources such as Secure Shell (SSH) via port 22.
Remediation
From Console
- Login to OCI Console.
- Click on
Networking -> Virtual Cloud Networksfrom the services menu. - For each VCN listed
Click on Security Lists. - Click on
Default Security List for <VCN Name>. - Identify the Ingress Rule with 'Source 0.0.0.0/0, IP Protocol 6 (TCP) and Destination Port Range 22'.
- Either Edit the Security rule to restrict the source and/or port range or delete the rule.
Usage
Run the control in your terminal:
powerpipe control run oci_compliance.control.cis_v200_2_5Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run oci_compliance.control.cis_v200_2_5 --shareSQL
This control uses a named query:
core_default_security_list_allow_icmp_only