What are the benefits of using IP whitelists to secure cloud servers/resources?

Question

Consider the following scenario:

• There is a "server" (e.g. database, API, etc) that is "in the cloud" (i.e. hosted on physical hardware that is physically distant from the clients and reachable only by IP through the public internet).
• The server only processes requests that provide valid credentials (e.g. password, access token, SSH key, etc.). It can be assumed that this authentication mechanism is "sufficiently secure". (i.e. an outside without knowledge of the credentials would not be able to fabricate credentials via reasonable brute force)
• The server is expected to only serve requests to a small list of clients that are pre-known. Each client sends its traffic from a fixed public IP address that is pre-known to the server.

What security benefits are providing by configuring an IP whitelist on the server? (i.e configuring the server to only accept incoming IP traffic from whitelisted IP addresses assuming the client provides valid credentials and to reject all other incoming traffic even if that incoming traffic provides valid credentials.) What types of attacks become impossible or more difficult based on the configuration of an IP whitelist on the server?

Answer 1

Security benefits:

1. If an attacker had stole your client credentials then he or she will have an additional trouble connecting to your server. Basically the intruder will have to connect from one of your client networks to have whitelisted IP address. An example of such a case: client looses his laptop or some one copies his hardrive or stole his flashdrive. IP of the client becomes one of the factors in your multifactor authentication system (credentials + IP address).

2. If your client has a malicious intent and leaves a simple backdoor on the server then after you revoke his access and remove his IP from the whitelist he would have an additional trouble connecting back to the server using the backdoor. If he didn't have root access to the server before then whitelist would make it impossible for him to connect through backdoor.

3. There are always some possibility that there will be a zeroday or oneday exploit to your authentication system (SSH or telnet or whatever you using). If your server blocks all traffic except whitelisted IPs then it makes impossible for an attacker to hack you from the internet. He or she would need to search for your whitelisted networks and then hack to some of them first.

Answer 2

Managing an IP whitelist can be administratively difficult if new clients are added or the IPs change. This can create outages for some clients while you update the whitelist. You also have to remember to prune the whitelist of invalid IPs.

Without the whitelist, anyone with valid credentials can log in. Former employees of the client, for instance. So, a whitelist means that you have to have valid credentials and be coming from a valid IP. This protection also applies to attackers brute-forcing credentials.

In general, IP whitelists limit the threat surface of your application. This means that any attack or threat (to your service's IP) can only come from an approved IP. Whitelists are great and effective for this purpose. But as I said, managing the whitelist is not scalable and presents its own issues. If you are expecting that your list of clients will grow or change rapidly, I would suggest investing now in more scalable options for protection.

Answer 3

The white-list access to a server for only known client IPs is something I have encountered occasionally and is an effective layer in a defense in depth approach. Here are the pros I see:

• By fully blocking access to only selected IPs, you practically eliminate your discover ability in the reconnaissance phase of an attack.
• If I can't access the exposed service from non-client IPs, you eliminate all of the typical attack vectors - password guessing, password stuffing, protocol flaws, etc.

And the cons:

• As pointed out, the maintenance of the white list can be cumbersome but the value may be worth it. The high-end way of doing this would be to have nothing exposed and to setup PPTP tunnel with your clients for pinpoint access.
• When you grant access to an IP from a business, you can't be sure of who is behind it. It may be a single egress IP for thousands of NAT'd employees. So although you've reduced your exposure to the public, you may still have malicious folks able to find you. Also, some company's share egress IPs with their private and guest networks. So make sure your clients are secure.

At the end of the day, I consider using an IP white list as a weak factor in an MFA approach. As in all things in security, it is just layer in the defenses. And in this case I think it is valuable.

Answer 4

You will be effectively reducing your attack surface. Only the malicious actors that have knowledge of your system would be able to perform an attacks on you.

Are you safe from malicious actors? No.

The universe that can do malicious activities will be lower and might reduce your administrative costs. On the other side you might also increase your administrative cost on the white list maintenance.

Finding the right balance between both is always a must.