NSG blocks Internet ingress to port 3389 (RDP)

Check ID: network_security_group_ingress_from_internet_to_rdp_port
Provider: Oracle Cloud (OCI)
Service: network
Severity: HIGH
Categories: internet-exposed
Resource type: NetworkSecurityGroup

What this check verifies

OCI Network Security Groups are evaluated for inbound source 0.0.0.0/0 permitting RDP on TCP 3389, including broad rules (all TCP or any protocol) that implicitly include that port.

Risk

Exposed RDP enables Internet-scale brute-force and protocol exploit attempts. Compromise yields interactive access for data exfiltration (C), unauthorized changes (I), and service disruption via ransomware (A), with potential lateral movement across the VCN.

Recommendation

Eliminate open 0.0.0.0/0 rules. Restrict RDP to trusted IPs and only when necessary. Prefer private connectivity via VPN, bastion/jump hosts, or zero-trust brokers. Apply least privilege and time-bound access, monitor logs, and disable RDP where unnecessary.

Remediation

CLI
Terraform
Dashboard steps

oci network nsg rules delete —network-security-group-id <NSG_OCID> —security-rule-id <SECURITY_RULE_ID>

resource "oci_core_network_security_group_security_rule" "<example_resource_name>" {
  network_security_group_id = "<example_resource_id>"
  direction = "INGRESS"
  protocol  = "6" # TCP
  source    = "10.0.0.0/8" # Critical: not 0.0.0.0/0; restricts RDP to an internal CIDR to remove internet exposure

  tcp_options {
    destination_port_range {
      min = 3389  # Critical: explicit RDP port
      max = 3389  # Critical: ensures only 3389 is allowed
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = network_security_group_ingress_from_internet_to_rdp_port. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Default security list restricts all traffic but ICMP NSG blocks Internet ingress to port 22 (SSH)

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires