When analyzing cloud findings for misconfigurations, which of the following would be considered a high-risk practice that should be flagged for remediation?

Allowing unrestricted inbound traffic (e.g., from any IP address, often represented as 0.0.0.0/0) to port 22 (SSH) is a critical security misconfiguration. This practice exposes a primary administrative access port for cloud-hosted virtual machines to the public internet. It creates a significant attack surface, making the resource highly susceptible to automated brute-force attacks, credential stuffing, and exploitation of known SSH vulnerabilities. Security best practices mandate restricting access to administrative ports to a limited set of known, trusted IP addresses, adhering to the principle of least privilege for network access.

A. Using network security groups (NSGs) to limit traffic to trusted IP addresses is a security best practice, not a high-risk practice.
C. Implementing role-based access control (RBAC) is a fundamental security measure for managing permissions and enforcing the principle of least privilege.
D. Enforcing multi-factor authentication (MFA) is a critical security control that strengthens identity verification and protects against account compromise.

1. Official Vendor Documentation (CrowdStrike): In a discussion of common cloud misconfigurations, CrowdStrike identifies "Unrestricted Outbound/Inbound Access" as a top risk. The documentation explicitly states, "Security groups that are open to the world (0.0.0.0/0) on sensitive ports like SSH (22) or RDP (3389) are a common finding... This misconfiguration allows anyone on the internet to attempt to connect to the resource."

Source: CrowdStrike Blog, "Top 10 Cloud Security Misconfigurations and How to Fix Them," Section: "Unrestricted Outbound/Inbound Access."

2. Industry Standard Framework (Referenced by Vendor Tools): The Center for Internet Security (CIS) Benchmarks, which form the basis for many CrowdStrike Falcon® Cloud Security policies, explicitly define this as a high-risk finding. The recommendation is to ensure no security groups allow unrestricted ingress to port 22.

Source: CIS AWS Foundations Benchmark v2.0.0, Recommendation 5.1, "Ensure no security groups allow ingress from 0.0.0.0/0 to port 22," Page 235.

3. University Courseware: Reputable cybersecurity curricula emphasize the danger of exposing management ports. Network security principles taught in these courses highlight that services like SSH should never be exposed to the entire internet but should instead be placed behind bastion hosts or restricted by source IP address.

Source: University of California, Berkeley. CS 161: Computer Security, Lecture 18: "Network Security," Slide 45. Discusses firewall rules and the importance of denying default access and only allowing specific, necessary traffic.