🛡️ Oracle IAAS Default Security List allows unrestricted non-ICMP traffic🟢
- Contextual name: 🛡️ IAAS Default Security List allows unrestricted non-ICMP traffic🟢
- ID:
/ce/ca/oracle/compute/default-security-list-does-not-restrict-all-traffic - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Logic
Similar Policies
- Internal:
dec-x-d3512f61
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-x-d3512f61 | 1 |
Description
Description
This policy identifies Default Oracle IAAS Security Lists that allow non-ICMP traffic from or to the internet.
Rationale
A default security list is created when a VCN is created and can be attached to public subnets in the VCN. Security lists provide stateful or stateless filtering of ingress and egress network traffic to OCI resources in the VCN. Leaving internet-reachable ingress or broad internet egress in the default security list increases the risk of unauthorized access and data exfiltration. Restricting these default rules reduces baseline exposure and encourages the use of explicitly approved network controls.
ICMP is excepted because it is commonly required for network diagnostics and control-plane behavior such as reachability testing and path MTU discovery. ICMP does not provide application-layer access in the same way as TCP or UDP services, but it should still be limited to approved operational needs.
Impact
For existing environments, before removing an ingress rule with a source of
0.0.0.0/0, confirm that the required access is provided through another Network Security Group or Security List.... see more
Remediation
Remediation
Restrict the Default Security List
From OCI CLI
Retrieve the current default security list configuration:
oci network security-list get \
--security-list-id {{default-security-list-ocid}}Create updated rule files that remove:
- non-
ICMPingress rules with source0.0.0.0/0- non-
ICMPegress rules with destination0.0.0.0/0Then apply the revised ingress and egress rule sets:
oci network security-list update \
--security-list-id {{default-security-list-ocid}} \
--ingress-security-rules file://ingress-rules.json \
--egress-security-rules file://egress-rules.jsonThe
ingress-rules.jsonandegress-rules.jsonfiles must contain the complete final rule sets for the default security list. Preserve only the rules that are still required after remediation, and verify that any removed public ingress or public egress is replaced by dedicated Security Lists or Network Security Groups where appropriate. Keep ICMP rules only when they are required for approved diagnostics or network control behavior.