cis-aws-storage-3-6

name	cis-aws-storage-3.6
description	Ensure Secure Ports for AWS storage services (S3, EFS, EBS)
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","efs","s3","ebs","ports","security-groups","nacl","network-security"]
cis_id	3.6
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-3.4","cis-aws-storage-3.5"]
prerequisites	[]
severity_boost	{}

3.6 Ensure Secure Ports (Manual)

Profile Applicability

• Level 2

Description

Securing network ports is essential for protecting AWS storage services like Amazon S3, EFS, and EBS. By configuring security groups and network access control lists (NACLs) to allow only necessary traffic, you minimize the risk of unauthorized access. Regular audits and monitoring of port usage ensure that only approved ports and protocols are operational, enhancing the overall security of your AWS storage environment.

Rationale

By limiting traffic to only necessary and approved ports and protocols, you reduce the attack surface and enhance the overall security of your storage environment. Regular audits and monitoring further ensure that security measures remain effective and up-to-date, safeguarding your data from emerging threats.

Impact

Not securing network ports in AWS storage services can lead to significant vulnerabilities, exposing your data to unauthorized access and potential breaches. This lack of control increases the risk of malicious attacks, such as port scanning and exploitation of open ports, which can result in data loss, corruption, and theft. Consequently, your organization may face severe financial losses, operational disruptions, and damage to its reputation.

Audit Procedure

Console

1. Review Security Group Configurations:

   1. Navigate to "Security Groups" under "Network & Security".
   2. Verify that security groups are configured to allow only necessary inbound and outbound traffic.
   3. Ensure rules are in place to restrict access to critical storage services, such as Amazon S3, EFS, and EBS.

2. Check Network Access Control Lists (NACLs):

   • Steps:
     1. Navigate to "Network ACLs" under "Security".
     2. Ensure NACLs are configured to control traffic to and from subnets, allowing only necessary ports and protocols.
     3. Verify that rules are implemented to deny unauthorized access.

3. Monitor VPC Flow Logs:

   • Steps:
     1. Enable VPC Flow Logs for each VPC.
     2. Regularly review flow logs to monitor traffic and identify any unauthorized access attempts or anomalies.
     3. Investigate and remediate any unusual traffic patterns.

4. Inspect IAM Policies and Roles:

   • Steps:
     1. Review IAM policies to ensure they enforce least privilege principles for access to security groups and NACLs.