1

Consider the following scenario:

  • There is a "server" (e.g. database, API, etc) that is "in the cloud" (i.e. hosted on physical hardware that is physically distant from the clients and reachable only by IP through the public internet).
  • The server only processes requests that provide valid credentials (e.g. password, access token, SSH key, etc.). It can be assumed that this authentication mechanism is "sufficiently secure". (i.e. an outside without knowledge of the credentials would not be able to fabricate credentials via reasonable brute force)
  • The server is expected to only serve requests to a small list of clients that are pre-known. Each client sends its traffic from a fixed public IP address that is pre-known to the server.

What security benefits are providing by configuring an IP whitelist on the server? (i.e configuring the server to only accept incoming IP traffic from whitelisted IP addresses assuming the client provides valid credentials and to reject all other incoming traffic even if that incoming traffic provides valid credentials.) What types of attacks become impossible or more difficult based on the configuration of an IP whitelist on the server?

  • 1
    Can you clarify your meaning of "configuring an IP whitelist on the server?" Do you mean "only allow connection from whitelisted IPs and block everything else?" That seems like the default meaning but given @Overmind's comment below, it may not be clear. – dwizum May 9 at 13:42
  • @dwizum Your interpretation of whitelist is correct. The description of the tag for whitelist is A whitelist shows data that specifically is allowed. All other data (not on the whitelist) will be filtered out or ignored. It's not clear to me why there is confusion on this but I can update the question if it adds clarity. – Jacob Horbulyk May 9 at 15:25
  • Filtered does not mean blocked. It means further processed. A CISCO firewall does have an implicit end deny on the WAN part, a random server configuration does not. You should specify which case you want to refer to. – Overmind May 10 at 8:33
4
+50

Security benefits:

  1. If an attacker had stole your client credentials then he or she will have an additional trouble connecting to your server. Basically the intruder will have to connect from one of your client networks to have whitelisted IP address. An example of such a case: client looses his laptop or some one copies his hardrive or stole his flashdrive. IP of the client becomes one of the factors in your multifactor authentication system (credentials + IP address).

  2. If your client has a malicious intent and leaves a simple backdoor on the server then after you revoke his access and remove his IP from the whitelist he would have an additional trouble connecting back to the server using the backdoor. If he didn't have root access to the server before then whitelist would make it impossible for him to connect through backdoor.

  3. There are always some possibility that there will be a zeroday or oneday exploit to your authentication system (SSH or telnet or whatever you using). If your server blocks all traffic except whitelisted IPs then it makes impossible for an attacker to hack you from the internet. He or she would need to search for your whitelisted networks and then hack to some of them first.

3

Managing an IP whitelist can be administratively difficult if new clients are added or the IPs change. This can create outages for some clients while you update the whitelist. You also have to remember to prune the whitelist of invalid IPs.

Without the whitelist, anyone with valid credentials can log in. Former employees of the client, for instance. So, a whitelist means that you have to have valid credentials and be coming from a valid IP. This protection also applies to attackers brute-forcing credentials.

In general, IP whitelists limit the threat surface of your application. This means that any attack or threat (to your service's IP) can only come from an approved IP. Whitelists are great and effective for this purpose. But as I said, managing the whitelist is not scalable and presents its own issues. If you are expecting that your list of clients will grow or change rapidly, I would suggest investing now in more scalable options for protection.

  • 1
    A whitelist does not block anything. With or without the whitelist, anyone with valid credentials can log in, as the question does not mention that everything else will be blocked. So if the desire is to allow only the whitelisted ones, then you have to block everything else, which may interfere with other possibly needed traffic. – Overmind May 9 at 11:25
  • @Overmind please read the comments on the question. Why would a whitelist not also imply a deny all at the end? – schroeder May 9 at 22:09
  • 1
    If a whitelist would not deny everything else, why would you whitelist anything? – BenoitBalliu1 May 10 at 5:45
  • 2
    @Overmind the context of even the original version of the question is clear that the traditional, standard meaning of "whitelist" was meant. And that the purpose of the whitelist is to block anything not on the whitelist. Your statement that "A whitelist does not block anything." is factually wrong. There are implementations of whitelists that do not block, sure, but your statement is just false. – schroeder May 10 at 7:17
  • 1
    @Overmind I, along with the OP, are baffled why this is even a question or matter for debate. For over 20 years of my work in networking and security, a whitelist implies a binary decision. That there are implementations in other use-cases that use it differently does not matter to anything. IP access whitelists block. IP reputation whitelists are not in scope of the question. Please take all further discussion to chat. – schroeder May 10 at 8:54
1

The white-list access to a server for only known client IPs is something I have encountered occasionally and is an effective layer in a defense in depth approach. Here are the pros I see:

  • By fully blocking access to only selected IPs, you practically eliminate your discover ability in the reconnaissance phase of an attack.
  • If I can't access the exposed service from non-client IPs, you eliminate all of the typical attack vectors - password guessing, password stuffing, protocol flaws, etc.

And the cons:

  • As pointed out, the maintenance of the white list can be cumbersome but the value may be worth it. The high-end way of doing this would be to have nothing exposed and to setup PPTP tunnel with your clients for pinpoint access.
  • When you grant access to an IP from a business, you can't be sure of who is behind it. It may be a single egress IP for thousands of NAT'd employees. So although you've reduced your exposure to the public, you may still have malicious folks able to find you. Also, some company's share egress IPs with their private and guest networks. So make sure your clients are secure.

At the end of the day, I consider using an IP white list as a weak factor in an MFA approach. As in all things in security, it is just layer in the defenses. And in this case I think it is valuable.

-1

You will be effectively reducing your attack surface. Only the malicious actors that have knowledge of your system would be able to perform an attacks on you.

Are you safe from malicious actors? No.

The universe that can do malicious activities will be lower and might reduce your administrative costs. On the other side you might also increase your administrative cost on the white list maintenance.

Finding the right balance between both is always a must.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.