Skip to main content

💼 1.2 Prevent access to the administrative interface from the internet

  • Contextual name: 💼 1.2 Prevent access to the administrative interface from the internet
  • ID: /frameworks/uk-cyber-essentials-v3.1/01/02
  • Located in: 💼 1 Firewalls

Description

Prevent access to the administrative interface (used to manage firewall configuration) from the internet, unless there is a clear and documented business need, and the interface is protected by one of the following controls:

  • multi-factor authentication (see MFA details below)
  • an IP allow list that limits access to a small range of trusted addresses combined with a properly managed password authentication approach

Similar

  • Internal
    • ID: dec-c-7623022b

Sub Sections

SectionSub SectionsInternal RulesPoliciesFlags

Policies (38)

PolicyLogic CountFlags
📝 AWS API Gateway REST API Stage is not associated with a WAF Web ACL 🟢1🟢 x6
📝 AWS DMS Replication Instance is publicly accessible 🟢1🟢 x6
📝 AWS EC2 Auto Scaling Group behind ELB assigns public IP to instances 🟢1🟢 x6
📝 AWS EC2 Default Security Group does not restrict all traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports 🟢1🟢 x6
📝 AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted CIFS traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted DNS traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted FTP traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted ICMP traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted NetBIOS traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted RPC traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted SMTP traffic 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to all ports 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MongoDB 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MSSQL 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MySQL 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to Oracle DBMS 🟢1🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to PostgreSQL 🟢1🟢 x6
📝 AWS RDS Instance is publicly accessible and in an unrestricted public subnet 🟢1🟢 x6
📝 AWS RDS Snapshot is publicly accessible 🟢1🟢 x6
📝 AWS S3 Bucket is not configured to block public access 🟢1🟢 x6
📝 Azure Cosmos DB Account Private Endpoints are not used 🟢1🟢 x6
📝 Azure Cosmos DB Account Virtual Network Filter is not enabled 🟢1🟢 x6
📝 Azure Cosmos DB Entra ID Client Authentication is not used 🟢🟢 x3
📝 Azure Key Vault Private Endpoints are not used 🟢1🟢 x6
📝 Azure Managed Disk Public Network Access is not disabled 🟢1🟢 x6
📝 Azure Network Security Group allows public access to HTTP(S) ports 🟢1🟢 x6
📝 Azure Network Security Group allows public access to RDP port 🟢1🟢 x6
📝 Azure Network Security Group allows public access to SSH port 🟢1🟢 x6
📝 Azure PostgreSQL Flexible Server Firewall Rules allow access to Azure services 🟢1🟢 x6
📝 Azure SQL Database allows ingress from 0.0.0.0/0 (ANY IP) 🟢1🟢 x6
📝 Azure SQL Database Transparent Data Encryption is not enabled 🟢1🟢 x6
📝 Azure SQL Server Microsoft Entra authentication is not configured 🟢1🟢 x6
📝 Azure SQL Server Public Network Access is not disabled 🟢1🟢 x6
📝 Azure Storage Account Allow Blob Anonymous Access is enabled 🟢1🟢 x6
📝 Azure Storage Account Default Network Access Rule is not set to Deny 🟢1🟢 x6
📝 Azure Storage Account Private Endpoints are not used 🟢1🟢 x6

Internal Rules

RulePoliciesFlags
✉️ dec-x-2fcb6d852
✉️ dec-x-3e379c671
✉️ dec-x-3e95721c1
✉️ dec-x-4c15a09f1
✉️ dec-x-4f30f24e1
✉️ dec-x-6eab9b881
✉️ dec-x-11c3009f1
✉️ dec-x-14bf01f31
✉️ dec-x-42a090841
✉️ dec-x-46a83a301
✉️ dec-x-0289e9c91
✉️ dec-x-293ab45b1
✉️ dec-x-599c86b41
✉️ dec-x-807a37c91
✉️ dec-x-66358b451
✉️ dec-x-083928f51
✉️ dec-x-637372481
✉️ dec-x-843426501
✉️ dec-x-a7d8f0e71
✉️ dec-x-b4d3d9dc2
✉️ dec-x-b17c005c1
✉️ dec-x-b33429051
✉️ dec-x-bcae85fb2
✉️ dec-x-bf1f13f61
✉️ dec-x-bfdadcc41
✉️ dec-x-ca1c0c0d1
✉️ dec-x-d127f4071
✉️ dec-x-e02b5fdd1
✉️ dec-x-ec547a7c1
✉️ dec-x-ecd99f881
✉️ dec-x-f4cc003a1
✉️ dec-x-f12d78aa1
✉️ dec-x-f937c35f1
✉️ dec-z-c82c9f971
✉️ dec-z-dbeeed9f1
✉️ dec-z-f778950c1