During a weekly cloud posture scan, a city engineer finds a security group that allows SSH from 0.0.0.0/0 to a management subnet. Why is this finding important for attack monitoring?
Select an answer to reveal the explanation.
Short Explanation
Leaving SSH open to the whole Internet is like hanging a ‘try this lock’ sign on City Hall’s side door. Attackers scrape those ranges constantly. Close it down to jump hosts or known admin networks before someone else finds the door first.
Full Explanation
Finding a security group that allows SSH from 0.0.0.0/0 to a management subnet matters because open management ports to the entire Internet create unnecessary attack surface that scanners and attackers continuously probe and exploit. Restrict SSH and similar admin protocols to bastions or known administrative networks as part of municipal attack-surface monitoring. Worldwide SSH access is not required for load-balancer health probes, which target application health endpoints rather than management shells. Claiming security groups only filter outbound DNS—and that inbound 0.0.0.0/0 therefore has no impact—misstates how cloud stateful filters work. Public SSH encryption protects the channel but does not make open source ranges safe when credentials or keys are stolen or guessed. Exam caveat: posture tools prioritize broad management exposure even when labeled temporary; temporary Internet SSH in city accounts routinely becomes permanent control debt. Operational check: replace 0.0.0.0/0 with approved admin CIDRs or require a bastion, verify SSH succeeds only from the approved path, re-run the weekly cloud posture scan until the finding clears, and document the management-plane zoning standard for civic subnets in the hardening guide.