Check ID: networking_port_security_disabled
Provider: OpenStack
Service: networking
Severity: HIGH
Categories: trust-boundaries, vulnerabilities
Resource type: OS::Neutron::Net

​
What this check verifies

OpenStack networks and ports are evaluated to verify that port security is enabled (port_security_enabled=True). Port security prevents MAC and IP spoofing by enforcing anti-spoofing rules. When disabled, instances can forge source addresses, bypass network isolation, and enable man-in-the-middle attacks. Disabling is sometimes required for NFV/SR-IOV use cases.

​
Risk

Disabled port security allows MAC/IP spoofing attacks, bypassing network isolation. Attackers can intercept traffic via ARP poisoning (MITM attacks), bypass security group rules by forging source IPs, and attack other tenants in multi-tenant environments (cross-tenant data exfiltration). Security groups cannot be enforced properly. Violates compliance requirements (PCI-DSS, HIPAA, SOC 2).

​
Recommendation

Enable port security on all networks and ports to prevent MAC and IP spoofing attacks. For legitimate NFV or SR-IOV use cases requiring disabled port security, deploy on isolated networks with compensating controls like network-level ACLs and monitoring. Use allowed-address-pairs instead of disabling port security when additional IPs are needed.

​
Remediation

# Terraform: ensure port security is enabled on networks and ports

# GOOD: Network with port security enabled (default)
resource "openstack_networking_network_v2" "secure_network" {
  name           = "prod-app-network"
  admin_state_up = true
  # port_security_enabled defaults to true - explicitly set for clarity
  # No need to specify if keeping default
}

# GOOD: Explicitly enable port security
resource "openstack_networking_network_v2" "explicit_security" {
  name           = "prod-web-network"
  admin_state_up = true
  # Explicitly enable port security
  # Note: Check if your OpenStack provider version supports this attribute
}

# GOOD: Port with port security enabled
resource "openstack_networking_port_v2" "secure_port" {
  name           = "instance-port-01"
  network_id     = openstack_networking_network_v2.secure_network.id
  admin_state_up = true
  
  # Port security enabled by default
  # Apply security groups
  security_group_ids = [
    openstack_networking_secgroup_v2.web_sg.id,
  ]
  
  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.subnet.id
  }
}

# BAD: Port with port security disabled (security risk)
# resource "openstack_networking_port_v2" "insecure_port" {
#   name           = "nfv-port-01"
#   network_id     = openstack_networking_network_v2.network.id
#   admin_state_up = true
#   
#   # DANGEROUS: Disabling port security allows MAC/IP spoofing
#   port_security_enabled = false
#   
#   # Security groups cannot be enforced without port security
#   # security_group_ids = []  # Must be empty when port_security_enabled = false
# }

# ACCEPTABLE: Disabled port security for legitimate NFV use case with documentation
resource "openstack_networking_port_v2" "nfv_port" {
  name           = "nfv-vrouter-port"
  network_id     = openstack_networking_network_v2.nfv_network.id
  admin_state_up = true
  
  # Port security disabled for NFV virtual router
  # JUSTIFICATION: SR-IOV network function requires promiscuous mode
  # COMPENSATING CONTROLS: 
  #   - Isolated network (no shared tenants)
  #   - Network-level ACLs via provider firewall
  #   - Monitoring for anomalous traffic patterns
  port_security_enabled = false
  
  # Cannot use security groups with disabled port security
  security_group_ids = []
}

# Create dedicated isolated network for resources requiring disabled port security
resource "openstack_networking_network_v2" "nfv_network" {
  name           = "nfv-isolated-network"
  admin_state_up = true
  # Isolated network - not shared with other projects
  shared = false
}

# Validation: Check port security is enabled
resource "null_resource" "validate_port_security" {
  depends_on = [openstack_networking_port_v2.secure_port]
  
  provisioner "local-exec" {
    command = <<-EOF
      # Verify port security is enabled
      PORT_SECURITY=$(openstack port show ${openstack_networking_port_v2.secure_port.id} -f json | jq -r '.port_security_enabled')
      if [ "$PORT_SECURITY" != "true" ]; then
        echo "ERROR: Port security is disabled on ${openstack_networking_port_v2.secure_port.id}"
        exit 1
      fi
      echo "✓ Port security validation passed"
    EOF
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = networking_port_security_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks