During a weekly cloud posture scan, a city engineer finds a security group that allows SSH from 0.0.0.0/0 to a management subnet. Why is this finding important for attack monitoring?
Select an answer to reveal the explanation.
Short Explanation
Leaving SSH open to the whole Internet is like hanging a ‘try this lock’ sign on City Hall’s side door. Attackers scrape those ranges constantly. Close it down to jump hosts or known admin networks before someone else finds the door first.
Full Explanation
Overly permissive inbound rules—especially SSH or RDP to 0.0.0.0/0—are high-priority findings because they expose management planes to continuous Internet scanning and credential attacks. Network security controls should restrict administrative access to bastions or approved source ranges. Encryption of the SSH protocol does not make unrestricted source ranges safe.