💼 SC-7(5) Boundary Protection | Deny by Default — Allow by Exception

• Contextual name: 💼 SC-7(5) Boundary Protection | Deny by Default — Allow by Exception
• ID: /frameworks/nist-sp-800-53-r5/sc/07/05
• Located in: 💼 SC-7 Boundary Protection

Description

Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for [Assignment: organization-defined systems]].

Similar

• Sections
  • /frameworks/aws-fsbp-v1.0.0/ec2/02
  • /frameworks/aws-fsbp-v1.0.0/ec2/18
  • /frameworks/aws-fsbp-v1.0.0/ec2/19
  • /frameworks/aws-fsbp-v1.0.0/ec2/21
  • /frameworks/aws-fsbp-v1.0.0/elasticache/07
  • /frameworks/aws-fsbp-v1.0.0/network-firewall/06
  • /frameworks/aws-fsbp-v1.0.0/rds/02
  • /frameworks/aws-fsbp-v1.0.0/rds/23
• Internal
  • ID: dec-c-c57baa23

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.2] VPC default security groups should not allow inbound or outbound traffic			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.19] Security groups should not allow unrestricted access to ports with high risk			10
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElastiCache.7] ElastiCache clusters should not use the default subnet group
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [NetworkFirewall.6] Stateless Network Firewall rule group should not be empty
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.23] RDS instances should not use a database engine default port		1	1

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP High Security Controls → 💼 SC-7(5) Deny by Default — Allow by Exception (M)(H)			18

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags

Policies (18)

Policy	Logic Count	Flags
📝 AWS EC2 Default Security Group does not restrict all traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted CIFS traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted FTP traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted RPC traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted SMTP traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MSSQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MySQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to PostgreSQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted Telnet traffic 🟢	1	🟢 x6
📝 AWS RDS Instance is publicly accessible and in an unrestricted public subnet 🟢	1	🟢 x6
📝 AWS RDS Instance uses default endpoint port 🟢	1	🟢 x6
📝 AWS VPC Network ACL exposes admin ports to public internet ports 🟢	1	🟢 x6
📝 Azure Network Security Group allows public access to HTTP(S) ports 🟢	1	🟢 x6
📝 Azure Network Security Group allows public access to RDP port 🟢	1	🟢 x6
📝 Azure Network Security Group allows public access to SSH port 🟢	1	🟢 x6
📝 Azure PostgreSQL Flexible Server Firewall Rules allow access to Azure services 🟢	1	🟢 x6

Internal Rules

Rule	Policies	Flags
✉️ dec-x-4c15a09f	1
✉️ dec-x-599c86b4	1
✉️ dec-x-bf1f13f6	1
✉️ dec-x-f4cc003a	1