Firewall rules should prohibit unrestricted RDP access from the internet
Inspects VPC firewall rules and verifies that the allowed ports do not include RDP port `3389`. Internet-exposed rules that permit inbound RDP (`TCP 3389`) from the source range `0.0.0.0/0` are flagged as failing.
Exposed RDP enables Internet-wide scanning and brute force. Exploits can yield remote code execution, followed by lateral movement and data theft. This endangers confidentiality, integrity, and availability (e.g., ransomware, service disruption).
What this control checks
Checks firewall rules for RDP access that is open to the internet
Common pitfalls
All TCP ports or all protocols also flagged
Prowler flags internet-exposed VPC firewall rules permitting inbound RDP (TCP 3389) from 0.0.0.0/0, including ingress rules that allow all TCP ports or all protocols.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_firewall_rdp_access_from_the_internet_allowed (prowler gcp --checks compute_firewall_rdp_access_from_the_internet_allowed); PowerPipe controls gcp_compliance.control.restrict_firewall_rule_rdp_world_open and gcp_compliance.control.restrict_firewall_rule_world_open_tcp_udp_all_ports.
Scans of the Terraform code that flag the same setting before deployment: KICS query "RDP Access Is Not Restricted" (678fd659-96f2-454a-a2a0-c2571f83a4a3).
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...) and CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...).
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.) and 6 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security).
NIS2 Directive (EU 2022/2555): Mapped to 1.1.1.c (set out network and information security objectives;), 1.2.1 (As part of their policy on the security of network and information systems referred to in point 1.1., the relevant...), 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...) and 7 more clauses.
NIST SP 800-53 Rev 5: Mapped to CA-9 (Internal System Connections) and SC-7 (Boundary Protection).
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
4 more clauses
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A.8.20 Network security
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
- CA-9 Internal System Connections
- SC-7: Boundary Protection
- 3.7 Ensure That RDP Access Is Restricted From the Internet
- 3.7 Ensure That RDP Access Is Restricted From the Internet
- AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules...
- COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
5 more clauses
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.7 GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses,...
- 164.308(a)(1)(ii)(B) Risk management
- 164.310(a)(1) Facility access controls
- 164.312(e)(1) Transmission security
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 636
- Firewall rules should prohibit ingress from 0.0.0.0/0 to MySQL DB port 3306
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 9200 or 9300
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 7199
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 137-139
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_firewall_rule_rdp_world_open - Powerpipe Controls:
gcp_compliance.control.restrict_firewall_rule_rdp_world_open,gcp_compliance.control.restrict_firewall_rule_world_open_tcp_udp_all_ports - Prowler Check:
compute_firewall_rdp_access_from_the_internet_allowed - KICS Query:
678fd659-96f2-454a-a2a0-c2571f83a4a3
Last reviewed: 2026-10-10