Risk Level: Medium
Cloud Entity: Network Load Balancer
CloudGuard Rule ID: D9.AWS.NET.AG2.5.NetworkLoadBalancer.22.TCP
Covered by Spectral: No
Category: Networking & Content Delivery
NetworkLoadBalancer where inboundRules contain [port <= 22 and portTo >= 22 and protocol in ('TCP','ALL')] should not have inboundRules contain [port <= 22 and portTo >= 22 and protocol in ('TCP','ALL') and scope numberOfHosts() > 256]
It is recommended to remove the rules that allow permissive SSH/Remote/Admin access.
As a further protection, use CloudGuard Dynamic Access Leasing to limit access to SSH/Remote Desktop only from allowed sources and only when needed.
For more information please refer to: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Network-Security/DynAccessLease.html?tocpath=Network%20Security%7C_____3
A Network Load Balancer functions at the fourth layer of the Open Systems Interconnection (OSI) model. It can handle millions of requests per second. After the load balancer receives a connection request, it selects a target from the target group for the default rule. It attempts to open a TCP connection to the selected target on the port specified in the listener configuration.
Updated 2 months ago