NetBIOS Port Should Not Be Open
More Info:
Determines if UDP port 137 or 138 for NetBIOS is open to the publicRisk Level
MediumAddress
SecurityCompliance Standards
SOC2, GDPR, ISO27001, HIPAA, HITRUST, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the NetBIOS port being open misconfiguration in GCP using GCP console, follow these steps:
- Login to your GCP console.
- Select the project where the misconfiguration exists.
- Navigate to the Compute Engine section.
- Select the VM instance where the misconfiguration exists.
- Click on the “Edit” button at the top of the VM instance details page.
- Scroll down to the “Firewall” section.
- Click on “Add firewall rule”.
- Enter a name for the firewall rule.
- Set the “Action on match” to “Deny”.
- Set the “Targets” to “All instances in the network”.
- In the “Source filter” section, select “IP ranges”.
- Enter the IP range that you want to block.
- In the “Protocols and ports” section, select “Specified protocols and ports”.
- In the “Protocols and ports” field, enter “udp:137; udp:138; tcp:139; tcp:445” to block NetBIOS traffic.
- Click on the “Create” button to save the firewall rule.
Using CLI
Using CLI
To remediate the NetBIOS Port Should Not Be Open misconfiguration in GCP using GCP CLI, follow these steps:
- Open the Cloud Shell in the GCP console.
-
Run the following command to list all the firewall rules in your project:
- Look for the firewall rule that allows traffic on port 139 or 445, which are the ports used by NetBIOS. Note the name of the firewall rule.
-
Run the following command to delete the firewall rule:
Replace
[FIREWALL_RULE_NAME]with the name of the firewall rule that you noted in step 3. - Confirm that the firewall rule has been deleted by running the command in step 2 again.
- Verify that the NetBIOS port is no longer open by running a port scan on your GCP instance from an external network.
Using Python
Using Python
To remediate the NetBIOS Port Should Not Be Open misconfiguration in GCP using Python, you can follow these steps:Note that you may need to adjust the code snippets to fit your specific use case, such as changing the filter expression or updating the firewall rule with different parameters.
- Use the
google-cloud-securitycenterlibrary to retrieve the list of assets that have open NetBIOS ports. You can use the following code snippet to achieve this:
- For each asset with an open NetBIOS port, use the
google-cloud-computelibrary to update the firewall rule and close the port. You can use the following code snippet to achieve this: