---
title: Inbound CIFS access should be restricted to trusted networks
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Inbound CIFS access should be
  restricted to trusted networks
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Inbound CIFS access should be restricted to trusted networks
 
## Description{% #description %}

AWS EC2 security groups should restrict inbound access to port 445, which is used by the Common Internet File System (CIFS), to trusted networks only. A security group fails when an inbound rule allows traffic from `0.0.0.0/0` or `::/0` either for all protocols (`-1`) or for a TCP/UDP port range that includes port 445. A security group whose inbound rules were not collected fails, as does one with an inbound rule whose protocol is missing, blank, or invalid, a TCP or UDP port range whose numeric bounds are missing, inverted, below 0, or above 65535, a source CIDR entry with missing or invalid syntax or the wrong address family, a prefix-list or source-security-group item without a nonblank identifier, or no source CIDR, prefix list, or security group. Every present source family must be well formed, even when another valid source family is present. Sources that reference a managed prefix list or another security group are not evaluated. Unrestricted CIFS access can expose file shares to unauthorized access, denial-of-service (DoS), and man-in-the-middle (MITM) attacks.

## Remediation{% #remediation %}

1. In the EC2 console Security Groups section, select the security group that allows unrestricted ingress on port 445, choose **Edit inbound rules**, and restrict the `0.0.0.0/0` or `::/0` source to specific trusted IP ranges.
1. Alternatively, remove each offending inbound rule with the AWS CLI as described in [revoke-security-group-ingress](https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html), and add a rule for a trusted CIDR range if access is still required. Repeat for every offending security group and region.

## References{% #references %}

- [Security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html)
- [AWS CLI revoke-security-group-ingress](https://docs.aws.amazon.com/cli/latest/reference/ec2/revoke-security-group-ingress.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)