Checks

OCI default security list of each VCN is evaluated to allow only VCN-internal ICMP. Non-ICMP ingress from 0.0.0.0/0 or sources outside the VCN, and non-ICMP egress to 0.0.0.0/0, are considered overly permissive. Only default lists are in scope.

AWS Network Firewall firewalls have deletion protection enabled (DeleteProtection=true).

VPCs with an AWS Network Firewall associated to the same VPC to inspect and filter network traffic.

Identifies VPCs that do not have a Network Firewall resource linked to them.

AWS Network Firewall has stateful engine logging configured with at least one log type (FLOW, ALERT, or TLS) and an active log destination

AWS Network Firewall firewalls are assessed for multi-AZ deployment, expecting subnet mappings in more than one Availability Zone.

A configuration with only one subnet mapping indicates a single-AZ firewall.

Network Firewall policies are assessed for the StatelessFragmentDefaultActions setting to confirm fragmented UDP packets use aws:drop or aws:forward_to_sfe.

AWS Network Firewall policies define a stateless default action for full packets. This evaluates whether unmatched packets are handled by aws:drop or aws:forward_to_sfe, meaning they are either discarded or sent to the stateful engine rather than allowed to pass.

Network Firewall policies have one or more stateful or stateless rule groups associated to define packet inspection and handling.

Policies with no rule groups are identified.

Azure Network Watcher has flow logs enabled for supported targets, such as virtual networks and network security groups, and configured with Traffic Analytics to forward records to a centralized Log Analytics workspace

Azure Network Watcher has flow logs enabled for supported targets, such as virtual networks and network security groups, and configured to retain for at least 90 days (or 0 for unlimited). The evaluation checks that flow logging is enabled and that the retention policy meets the required duration for each configured log.

Azure NSG are evaluated for inbound rules that allow public HTTP access on TCP 80, including cases where 80 is covered by a port range, from 0.0.0.0/0, Internet, or *.

OpenStack networks are evaluated to verify that admin_state_up is True (administratively enabled). Networks with admin_state_up=False cannot carry traffic and are typically disabled temporarily during maintenance or troubleshooting. Best practices recommend re-enabling networks promptly after maintenance to prevent service outages from forgotten disabled networks.

Linode Cloud Firewalls are checked to verify each one is attached to at least one device, such as a Linode instance or NodeBalancer. A firewall only filters traffic for the resources it is assigned to, so an unassigned firewall enforces no protection at all.

Linode Cloud Firewalls apply a default inbound policy to ingress traffic that does not match any explicit rule. This check verifies the default is set to DROP, enforcing a default-deny posture so that only traffic intentionally permitted by a rule is allowed in.

Linode Cloud Firewalls apply a default outbound policy to egress traffic that matches no explicit rule. This check verifies the default is set to DROP, enforcing default-deny egress so that only approved outbound connections are allowed to leave the instance.

Linode Cloud Firewalls are checked to determine whether explicit inbound rules are configured. Defined ingress rules express the intended allow-list of sources, ports, and protocols instead of relying solely on the firewall's default policy.

Linode Cloud Firewalls are checked to determine whether explicit outbound rules are configured. Defined egress rules express which destinations, ports, and protocols an instance is permitted to reach, rather than depending only on the firewall's default policy.

Linode Cloud Firewalls can be in an enabled or disabled state. This check verifies the firewall status is enabled, because a firewall must be active for its inbound and outbound policies and rules to actually filter network traffic.

OpenStack networks and ports are evaluated to verify that port security is enabled (port_security_enabled=True). Port security prevents MAC and IP spoofing by enforcing anti-spoofing rules. When disabled, instances can forge source addresses, bypass network isolation, and enable man-in-the-middle attacks. Disabling is sometimes required for NFV/SR-IOV use cases.

OpenStack security groups are evaluated to verify that no rule allows all ingress traffic (any protocol, any port) from the Internet (0.0.0.0/0 or ::/0). A rule with no protocol and no port restriction is effectively a "permit any" firewall rule, completely bypassing network-level access controls. This is the most permissive possible configuration and should never be used in production.

OpenStack security groups are evaluated to verify that RDP (port 3389) is not exposed to the Internet (0.0.0.0/0 or ::/0). Security groups act as virtual firewalls controlling Windows instance traffic. Unrestricted RDP access violates least privilege and creates significant attack surface. Best practices recommend restricting RDP to known IP ranges, RD Gateway, or VPN.

OpenStack security groups are evaluated to verify that SSH (port 22) is not exposed to the Internet (0.0.0.0/0 or ::/0). Security groups act as virtual firewalls controlling instance traffic. Unrestricted SSH access violates least privilege and creates significant attack surface. Best practices recommend restricting SSH to known IP ranges, bastion hosts, or VPN gateways.

OpenStack subnets are evaluated to verify that DHCP is enabled (enable_dhcp=True). DHCP automatically assigns IP addresses, DNS servers, and gateway information to instances at boot. Subnets with DHCP disabled require manual configuration, increasing operational complexity and IP conflict risk. Enable DHCP to simplify deployment and ensure cloud-init functionality.

Azure Public IP addresses are detected as indexed by Shodan, indicating Internet-visible services with open ports and service banner metadata.