Lion Cipher Lab
Lock down cloud inbound traffic with security groups
- Cloud Security
- Beginner
- ~30 min
- Free · no account required
Why it matters
The single most common way a cloud server gets compromised early is a security group left wide open: an inbound rule allowing the whole internet (0.0.0.0/0) to reach SSH (22) or RDP (3389). The internet is scanned continuously, so an admin port open to everyone is found within minutes and hammered with login attempts forever after. A security group is the cloud's built-in firewall for an instance, and getting its inbound rules right — allowing only the traffic that's actually needed, from only the sources that need it — is one of the highest-impact cloud-security habits. It's least privilege…
What you'll learn
- what a security group is (a stateful virtual firewall)
- reading inbound/outbound rules
- why 0.0.0.0/0 on admin ports is dangerous
- restricting a rule to your own IP
- applying least privilege to network access
Steps in this lab
- What a security group is
- Read your instance's inbound rules
- Find the dangerous rule: admin ports open to the world
- Restrict the source to just you
- Apply least privilege to every rule
- Confirm, and carry the pattern everywhere
- Why the network door matters most