Network security groups should have SSH access from the internet restricted
Checks that SSH access from the Internet is restricted on Azure network security groups. Prowler flags NSG inbound rules that allow SSH on TCP 22 from 0.0.0.0/0, Internet, or *. Trivy states SSH access should not be permitted from the internet.
Public SSH access weakens confidentiality and integrity. Open 22 invites brute force and key theft, enabling remote shell control, persistence, and lateral movement.
What this control checks
Fails if an NSG inbound rule allows SSH (TCP 22) from 0.0.0.0/0, Internet, any or *
Common pitfalls
SSH can be set on NSG or in rule
SSH access can be configured on either the network security group or in the network security group rule.
Rules with port 22 and TCP or * are identified
Rules where port ranges include 22 and protocol is TCP or * are identified.
Audit evidence
Evidence that deployed resources meet this control: Prowler check network_ssh_internet_access_restricted (prowler azure --checks network_ssh_internet_access_restricted); PowerPipe control azure_compliance.control.network_security_group_ssh_access_restricted.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_10; Trivy check AZU-0050.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.) and 7 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security), A.8.21 (Security of Network Services) and A.8.22 (Segregation of Networks).
NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 2.3.1 (The relevant entities shall review independently their approach to managing network and information system security and...), 6.7.2.b (determine and apply controls to protect the relevant entities internal network domains from unauthorised access;) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.1: Network connections between trusted and untrusted networks are controlled.
5 more clauses
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.4.4: System components that store cardholder data are not directly accessible from untrusted networks
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 8.2 Ensure that SSH access from the Internet is evaluated and restricted
- 7.2 Ensure that SSH access from the Internet is evaluated and restricted
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- Annex I (5.1)
- COS-03.01B The cloud service provider distincts between trusted and untrusted networks. Based on a risk assessment according to OIS-07, these are separated into different security zones for internal and external network areas (and DMZ, if applicable).
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 6.2 Ensure that SSH access is restricted from the internet
- 6.2 Ensure that SSH access is restricted from the internet
- 6.2 Ensure that SSH access from the internet is evaluated and restricted
- 6.2 Ensure that SSH access from the Internet is evaluated and restricted
- 6.2 Ensure that SSH access from the Internet is evaluated and restricted
- 7.2 Ensure that SSH access from the Internet is evaluated and restricted
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.310(a)(1) Facility access controls
- 164.312(a)(1) Access control
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_ssh_access_restricted - Checkov Check:
CKV_AZURE_10 - Powerpipe Control:
azure_compliance.control.network_security_group_ssh_access_restricted - Prowler Check:
network_ssh_internet_access_restricted - Trivy Check:
AZU-0050
Last reviewed: 2026-10-13