Default security list restricts all traffic but ICMP

Check ID: network_default_security_list_restricts_traffic
Provider: Oracle Cloud (OCI)
Service: network
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: SecurityList

What this check verifies

OCI default security list of each VCN is evaluated to allow only VCN-internal ICMP. Non-ICMP ingress from 0.0.0.0/0 or sources outside the VCN, and non-ICMP egress to 0.0.0.0/0, are considered overly permissive. Only default lists are in scope.

Risk

Over-permissive default rules expose subnet workloads to the Internet and enable unrestricted outbound traffic. This risks confidentiality (unauthorized access, data exfiltration), integrity (remote exploitation, lateral movement), and availability (DoS/C2) through broad non-ICMP 0.0.0.0/0 paths.

Recommendation

Adopt a deny-by-default stance on the default list: allow only VCN-local ICMP for diagnostics. Use dedicated security lists or network security groups per application to explicitly allow needed ports and sources, and restrict egress to approved ranges. Review regularly under least privilege.

Remediation

CLI
Terraform
Dashboard steps

oci network security-list update --security-list-id <default-security-list-ocid> --ingress-security-rules '[{"protocol":"1","source":"<VCN_CIDR>"}]' --egress-security-rules '[{"protocol":"1","destination":"<VCN_CIDR>"}]'

resource "oci_core_default_security_list" "<example_resource_name>" {
  manage_default_resource_id = "<default_security_list_ocid>"  # Critical: targets the default security list

  ingress_security_rules {
    protocol = "1"            # Critical: allow only ICMP
    source   = "<VCN_CIDR>"   # Critical: restrict to VCN
  }

  egress_security_rules {
    protocol    = "1"            # Critical: allow only ICMP
    destination = "<VCN_CIDR>"   # Critical: restrict to VCN
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = network_default_security_list_restricts_traffic. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Customer-managed KMS key rotates within 365 days NSG blocks Internet ingress to port 3389 (RDP)

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires