[fusion_builder_container hundred_percent="no" equal_height_columns="no" menu_anchor="" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id="" background_color="" background_image="" background_position="center center" background_repeat="no-repeat" fade="no" background_parallax="none" parallax_speed="0.3" video_mp4="" video_webm="" video_ogv="" video_url="" video_aspect_ratio="16:9" video_loop="yes" video_mute="yes" overlay_color="" video_preview_image="" border_size="" border_color="" border_style="solid" padding_top="" padding_bottom="" padding_left="" padding_right=""][fusion_builder_row][fusion_builder_column type="1_1" layout="1_1" background_position="left top" background_color="" border_size="" border_color="" border_style="solid" border_position="all" spacing="yes" background_image="" background_repeat="no-repeat" padding_top="" padding_right="" padding_bottom="" padding_left="" margin_top="0px" margin_bottom="0px" class="" id="" animation_type="" animation_speed="0.3" animation_direction="left" hide_on_mobile="small-visibility,medium-visibility,large-visibility" center_content="no" last="no" min_height="" hover_type="none" link=""][fusion_text columns="" column_min_width="" column_spacing="" rule_style="default" rule_size="" rule_color="" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id=""] AWS RDP Scanning I came across a great post from Joseph Wood at HP last week, on the recent dramatic increase in RDP scanning in AWS -- specifically scanning of the RDP port. Down in the comments someone asked, “Why anyone would allow port 3389 from the Internet?” That seems to be a very salient question, no? The first thing to know is that AWS leaves the RDP port open when configuring a new instance from the console (this issue is broader than just Amazon, as you’ll see below, but we’ll focus on AWS): [/fusion_text][fusion_imageframe image_id="4095|full" max_width="" style_type="" blur="" stylecolor="" hover_type="none" bordersize="" bordercolor="" borderradius="" align="center" lightbox="yes" gallery_id="" lightbox_image="https://disruptops.com/wp-content/uploads/2019/08/RDP-Scanning-AWS.png" lightbox_image_id="4095|full" alt="AWS RDP Scanning" link="" linktarget="_self" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id="" animation_type="" animation_direction="left" animation_speed="0.3" animation_offset=""]https://disruptops.com/wp-content/uploads/2019/08/RDP-Scanning-AWS.png[/fusion_imageframe][/fusion_builder_column][fusion_builder_column type="1_1" layout="1_1" spacing="yes" center_content="no" link="" target="_self" min_height="" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id="" background_image_id="" background_color="" background_image="" background_position="left top" background_repeat="no-repeat" hover_type="none" border_size="0" border_color="" border_style="solid" border_position="all" border_radius_top_left="" border_radius_top_right="" border_radius_bottom_left="" border_radius_bottom_right="" box_shadow="no" box_shadow_vertical="" box_shadow_horizontal="" box_shadow_blur="0" box_shadow_spread="0" box_shadow_color="" box_shadow_style="" padding_top="" padding_right="" padding_bottom="" padding_left="" margin_top="20px" margin_bottom="0px" animation_type="" animation_direction="left" animation_speed="0.3" animation_offset="" last="no"][fusion_text columns="" column_min_width="" column_spacing="" rule_style="default" rule_size="" rule_color="" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id=""] But that’s not a new issue and most people know how to address it. So why does Joseph’s data show it’s still such a common problem? Here are the counts of open 3389 ports he saw: [/fusion_text][fusion_imageframe image_id="4096|full" max_width="50%" style_type="" blur="" stylecolor="" hover_type="none" bordersize="" bordercolor="" borderradius="" align="center" lightbox="yes" gallery_id="" lightbox_image="https://disruptops.com/wp-content/uploads/2019/08/RDP-Scanning-AWS2.png" lightbox_image_id="4096|full" alt="AWS RDP Scanning" link="" linktarget="_self" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id="" animation_type="" animation_direction="left" animation_speed="0.3" animation_offset=""]https://disruptops.com/wp-content/uploads/2019/08/RDP-Scanning-AWS2.png[/fusion_imageframe][/fusion_builder_column][fusion_builder_column type="1_1" layout="1_1" spacing="yes" center_content="no" link="" target="_self" min_height="" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id="" background_image_id="" background_color="" background_image="" background_position="left top" background_repeat="no-repeat" hover_type="none" border_size="0" border_color="" border_style="solid" border_position="all" border_radius_top_left="" border_radius_top_right="" border_radius_bottom_left="" border_radius_bottom_right="" box_shadow="no" box_shadow_vertical="" box_shadow_horizontal="" box_shadow_blur="0" box_shadow_spread="0" box_shadow_color="" box_shadow_style="" padding_top="" padding_right="" padding_bottom="" padding_left="" margin_top="30px" margin_bottom="0px" animation_type="" animation_direction="left" animation_speed="0.3" animation_offset="" last="no"][fusion_text columns="" column_min_width="" column_spacing="" rule_style="default" rule_size="" rule_color="" hide_on_mobile="small-visibility,medium-visibility,large-visibility" class="" id=""] This is another example of a simple configuration mistake leading to potentially disastrous consequences , which will be followed by a chorus of security experts discussing how this should never happen. Yet in the real world it keeps happening. This highlights a point we make over and over again: securing small cloud infrastructure can be challenging, but as infrastructure grows the complexity and difficulty to secure it rises exponentially. And complexity leads to unintended exposures and other configuration mistakes, as Joseph points out. Of course we are biased, but we think Guardrails are the answer here. Guardrails don’t hamper DevOps, but do continuously ensure security controls are properly configured and automatically correcting mistakes. This can be accomplished at scale with minimal human involvement, which is essential to cloud security success. Of course we can help with RDP and ssh . DisruptOps detects open RDP ports across accounts and regions, and can react in a number of ways. You can choose a response ranging from notification, to manually executing an action (such as restricting the port to a trusted IP range or removing the security group), to a fully automated action, whenever the issue is detected. This is just one of a number of configuration mistakes which are particularly problematic in AWS. We can put guardrails around many more. Check out the full library. Or better yet, give us 20 minutes and you can see the full functionality of the DisruptOps platform in your AWS accounts. [/fusion_text][/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]

Matt Dean, Author at DisruptOps

About Matt Dean

Matt Dean brings over 15 years enterprise software security management experience to DisruptOps. Before evolving into FireMon, Matt spent a majority of his career developing Secure Passage into one of the industry leading enterprise firewall management platforms. Through his years, Matt has focused exclusively on developing key enterprise software security products that help businesses manage their IT vulnerabilities and assist with recommended remediations that has saved valuable time and money for countless businesses.