Open cardosec

Case 0A54B7 · Cloud · L1 Foundations

SSH Open to the Whole Internet

Practise as: Incident drill · InterviewLevel: L1 Foundations

Live alertA cloud security posture tool flags that a production web server's security group has allowed SSH (port 22) from 0.0.0.0/0 for the last 11 days. The instance uses password authentication.

Interview questionYou find SSH open to the internet on a production server. What do you do?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Close it now: remove the 0.0.0.0/0 rule; if admins need access, use a bastion, VPN or a session manager instead.
  2. Check for compromise: SSH auth logs for successful logins, VPC flow logs for connections, and unexpected users or processes.
  3. Find out how: CloudTrail shows who added the rule and when; was it a quick fix that was never reverted?
  4. Prevent: disable password logins, block 0.0.0.0/0 on admin ports with a guardrail, and alert on new rules like it.

If the interviewer pushes back

  • The logs show thousands of failed logins but no successes. Are you done?

Go deeper

More Cloud cards

All Cloud cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09