Skip to main content

💼 1.2 Prevent access to the administrative interface from the internet

  • ID: /frameworks/uk-cyber-essentials-v3.1/01/02

Stats​

not available

Description​

Prevent access to the administrative interface (used to manage firewall configuration) from the internet, unless there is a clear and documented business need, and the interface is protected by one of the following controls:

  • multi-factor authentication (see MFA details below)
  • an IP allow list that limits access to a small range of trusted addresses combined with a properly managed password authentication approach

Similar​

  • Internal
    • ID: dec-c-7623022b

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance

Policies (119)​

PolicyLogic CountFlagsCompliance
🛡️ AWS API Gateway REST API Stage is not associated with a WAF Web ACL🟢1🟢 x6no data
🛡️ AWS DMS Replication Instance is publicly accessible🟢1🟢 x6no data
🛡️ AWS EC2 Auto Scaling Group behind ELB assigns public IP to instances🟢1🟢 x6no data
🛡️ AWS EC2 Default Security Group does not restrict all traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted CIFS traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted DNS traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted FTP traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted ICMP traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted NetBIOS traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted RPC traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted SMTP traffic🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to all ports🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MongoDB🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MSSQL🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MySQL🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to Oracle DBMS🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to PostgreSQL🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted Telnet traffic🟢1🟢 x6no data
🛡️ AWS RDS Instance is publicly accessible🟢1🟢 x6no data
🛡️ AWS RDS Snapshot is publicly accessible🟢1🟢 x6no data
🛡️ AWS S3 Bucket is not configured to block public access🟢1🟢 x6no data
🛡️ Azure Cosmos DB Account Private Endpoints are not used🟢1🟢 x6no data
🛡️ Azure Cosmos DB Account Virtual Network Filter is not enabled🟢1🟢 x6no data
🛡️ Azure Cosmos DB Entra ID Client Authentication is not used🟢⚪🟢 x2, ⚪ x1no data
🛡️ Azure Databricks Workspace Allow Public Network Access is not disabled🟢1🟢 x6no data
🛡️ Azure Key Vault Private Endpoints are not used🟢1🟢 x6no data
🛡️ Azure Key Vault Public Network Access is enabled🟢1🟢 x6no data
🛡️ Azure Managed Disk Public Network Access is not disabled🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to all ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to CIFS port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to DNS port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to FTP ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to HTTP(S) ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to MongoDB ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to MSSQL port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to MySQL port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to NetBIOS ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to Oracle DBMS ports🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to PostgreSQL port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to RDP port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to RPC port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to SMTP port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to SSH port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public access to Telnet port🟢1🟢 x6no data
🛡️ Azure Network Security Group allows public UDP access🟢1🟢 x6no data
🛡️ Azure PostgreSQL Flexible Server Firewall Rules allow access to Azure services🟢1🟢 x6no data
🛡️ Azure SQL Database allows ingress from 0.0.0.0/0 (ANY IP)🟢1🟢 x6no data
🛡️ Azure SQL Database Transparent Data Encryption is not enabled🟢1🟢 x6no data
🛡️ Azure SQL Server Microsoft Entra authentication is not configured🟢1🟢 x6no data
🛡️ Azure SQL Server Public Network Access is not disabled🟢1🟢 x6no data
🛡️ Azure Storage Account Allow Blob Anonymous Access is enabled🟢1🟢 x6no data
🛡️ Azure Storage Account Default Network Access Rule is not set to Deny🟢1🟢 x6no data
🛡️ Azure Storage Account Private Endpoints are not used🟢1🟢 x6no data
🛡️ Azure Storage Account Public Network Access is not disabled🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to all ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to CIFS port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to DNS port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to FTP ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to HTTP(S) ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to MongoDB ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to MSSQL port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to MySQL port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to NetBIOS ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to Oracle DBMS ports🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to PostgreSQL port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to RDP port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to RPC port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to SMTP port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to SSH port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public access to Telnet port🟢1🟢 x6no data
🛡️ Azure Virtual Machine allows public UDP access🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to all ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to CIFS port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to DNS port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to FTP ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to HTTP(S) ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to MongoDB ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to MSSQL port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to MySQL port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to NetBIOS ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to Oracle DBMS ports🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to PostgreSQL port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to RDP port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to RPC port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to SMTP port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to SSH port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public access to Telnet port🟢1🟢 x6no data
🛡️ Azure VM Scale Set Instance allows public UDP access🟢1🟢 x6no data
🛡️ Google Cloud SQL Instance has public IP addresses🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted CiscoSecure/WebSM traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted DNS traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted FTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted HTTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted LDAP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted NetBIOS traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted POP3 traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted RDP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted SMTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted SSH traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to all ports🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Cassandra🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Directory services"🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Elasticsearch🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Memcached🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to MongoDB🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to MySQL🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to OracleDB🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to PostgreSQL🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Redis🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted Telnet traffic🟢1🟢 x6no data
🛡️ Google Storage Bucket is anonymously or publicly accessible🟢1🟢 x6no data
🛡️ Oracle IAAS Default Security List allows unrestricted non-ICMP traffic🟢1🟢 x6no data
🛡️ Oracle IAAS Network Security Group allows unrestricted RDP traffic🟢1🟢 x6no data
🛡️ Oracle IAAS Network Security Group allows unrestricted SSH traffic🟢1🟢 x6no data
🛡️ Oracle IAAS Security List allows unrestricted RDP traffic🟢1🟢 x6no data
🛡️ Oracle IAAS Security List allows unrestricted SSH traffic🟢1🟢 x6no data
🛡️ Oracle Storage Bucket allows public access🟢1🟢 x6no data

Internal Rules​

RulePoliciesFlags
✉️ dec-x-2c2e85001
✉️ dec-x-2fcb6d852
✉️ dec-x-3e379c671
✉️ dec-x-3e95721c1
✉️ dec-x-4c15a09f3
✉️ dec-x-4f30f24e1
✉️ dec-x-4f36e2c11
✉️ dec-x-4fc857231
✉️ dec-x-05aeca9a1
✉️ dec-x-5dc6b82a1
✉️ dec-x-6eab9b881
✉️ dec-x-7a66b0021
✉️ dec-x-7c438fc93
✉️ dec-x-7dd32fc82
✉️ dec-x-8a2089ff1
✉️ dec-x-11c3009f1
✉️ dec-x-14c7e63c1
✉️ dec-x-16d413433
✉️ dec-x-30d6f14d1
✉️ dec-x-42a090841
✉️ dec-x-46a83a301
✉️ dec-x-54e1aaf01
✉️ dec-x-60a4d8031
✉️ dec-x-85b34dad1
✉️ dec-x-87b8e6c71
✉️ dec-x-97f83e381
✉️ dec-x-0289e9c91
✉️ dec-x-293ab45b1
✉️ dec-x-376cc6e53
✉️ dec-x-501db6873
✉️ dec-x-539bc7d51
✉️ dec-x-599c86b43
✉️ dec-x-656b34c93
✉️ dec-x-708db3f81
✉️ dec-x-727ce9cb3
✉️ dec-x-749f6d5f3
✉️ dec-x-807a37c91
✉️ dec-x-892f536e1
✉️ dec-x-956c9ca51
✉️ dec-x-1122fe571
✉️ dec-x-5803e8191
✉️ dec-x-06394dfa3
✉️ dec-x-36226bed3
✉️ dec-x-66358b451
✉️ dec-x-083928f51
✉️ dec-x-637372481
✉️ dec-x-781465051
✉️ dec-x-843426501
✉️ dec-x-a7d8f0e71
✉️ dec-x-a960c3461
✉️ dec-x-aa8753bf1
✉️ dec-x-af1de99b1
✉️ dec-x-afca7c621
✉️ dec-x-b4d3d9dc2
✉️ dec-x-b17c005c1
✉️ dec-x-b43542b52
✉️ dec-x-b56086e73
✉️ dec-x-b33429051
✉️ dec-x-bb3a08511
✉️ dec-x-bcae85fb2
✉️ dec-x-bf1f13f61
✉️ dec-x-bfdadcc41
✉️ dec-x-c236fa5f1
✉️ dec-x-ca1c0c0d1
✉️ dec-x-cd1c9f221
✉️ dec-x-d8ad91bf1
✉️ dec-x-d39d55dd1
✉️ dec-x-d127f4072
✉️ dec-x-d327d1a01
✉️ dec-x-d2063d701
✉️ dec-x-d3512f611
✉️ dec-x-dca52d4d3
✉️ dec-x-de47b9383
✉️ dec-x-e02b5fdd1
✉️ dec-x-e43fd12e3
✉️ dec-x-e88c387f1
✉️ dec-x-ec547a7c1
✉️ dec-x-ecd99f881
✉️ dec-x-efa79ed13
✉️ dec-x-f4cc003a3
✉️ dec-x-f12d78aa1
✉️ dec-x-f937c35f1
✉️ dec-x-fab5c4cd1
✉️ dec-x-fe1e9cf11
✉️ dec-x-fe5d4f071