NetworkLoadBalancer with unencrypted Cassandra Monitoring (TCP:7199) is potentially exposed to the public internet

Risk Level: High
Cloud Entity: Network Load Balancer
CloudGuard Rule ID: D9.AWS.NET.AG2.1.NetworkLoadBalancer.7199.TCP
Covered by Spectral: No
Category: Networking & Content Delivery

GSL LOGIC

NetworkLoadBalancer where isPublic=true and nics contain [ subnet.routeTable.associations length()>0 ] and nics contain [ subnet.routeTable.routes contain [ destinationCidrBlock='0.0.0.0/0' and gatewayId regexMatch /gw/ ] ] should not have inboundRules contain [ port<=7199  and portTo>=7199  and protocol in ('TCP', 'ALL') and scope isPublic() and scope numberOfHosts()>=32 ]

REMEDIATION

It is recommended to remove the rules that allow permissive SSH/Remote/Admin access.

If public interface exists, remove it and limit the access scope within the VPC only to applications or instances that requires access.

Amazon Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html

As a further protection, use CloudGuard Dynamic Access Leasing to limit access to SSH/Remote Desktop only from allowed sources and only when needed.
For more information please refer to: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Network-Security/DynAccessLease.html?tocpath=Network%20Security%7C_____3

Network Load Balancer

A Network Load Balancer functions at the fourth layer of the Open Systems Interconnection (OSI) model. It can handle millions of requests per second. After the load balancer receives a connection request, it selects a target from the target group for the default rule. It attempts to open a TCP connection to the selected target on the port specified in the listener configuration.

Compliance Frameworks

• BP-0318
• CCMV301
• GDPR
• ISO27001
• LGPD
• MAS-TRM
• NETWSEC-V2
• NIST-CSF
• NIST800534
• PCIDSS32
• SOC2