1

We use AWS Inspector to identify risks with our AWS assets. Today I received a finding, with a "high" severity. The finding said that the FTP port was open to the internet. However, after reviewing the security group associated with the instance, I saw that the FTP port is only open to a set of whitelisted IP addresses that are trusted.

Does this really constitute a high severity in your opinion? Is it problematic to open ports to the internet with a specific set of whitelisted IPs?

2

If it is FTP (and not FTPS) then yes, it is a high severity risk. You are sending unencrypted traffic over the open internet. Even if you are whitelisting specific IP addresses, the traffic is still unencrypted between those specific instances.

In addition, FTP is a very old (created in 1971) and non-secure protocol. It is not meant to be a secure method of transferring files. I recommend you research some of the security concerns with FTP and switch to either FTPS or more preferably, use a more native AWS approach for transferring files between instances. If your organization is under any regulation (FEDRAMP, HIPPA, etc.), using FTP across the open internet will not meet the compliance requirements.

1
  • 1
    Ahh. I understand the issue better now. I don't actually use the FTP port, I just haven't run a thorough check of the ports for which my IP is whitelisted. But obviously, AWS does not know that. – Konrad Mar 10 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.