Answers: <p>If it is FTP (and not FTPS) then yes, it is a high severity risk. You are sending unencrypted traffic over the open internet. Even if you are whitelisting specific IP addresses, the traffic is still unencrypted between those specific instances.</p>
  <p>In addition, FTP is a very old (created in 1971) and non-secure protocol. It is not meant to be a secure method of transferring files. I recommend you research some of the security concerns with FTP and switch to either FTPS or more preferably, use a more native AWS approach for transferring files between instances. If your organization is under any regulation (FEDRAMP, HIPPA, etc.), using FTP across the open internet will not meet the compliance requirements.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-03-10T19:58:44.880Z
Answers: Ahh. I understand the issue better now. I don't actually use the FTP port, I just haven't run a thorough check of the ports for which my IP is whitelisted. But obviously, AWS does not know that.
Answers: Konrad
Answers: CC BY-SA 4.0
Answers: 2021-03-10T15:45:59.843Z
Answers: 2021-03-10T15:45:59.843Z
Answers: Preston Martin
Body: <p>We use AWS Inspector to identify risks with our AWS assets. Today I received a finding, with a &quot;high&quot; severity. The finding said that the FTP port was open to the internet. However, after reviewing the security group associated with the instance, I saw that the FTP port is only open to a set of whitelisted IP addresses that are trusted.</p>
  <p>Does this really constitute a high severity in your opinion? Is it problematic to open ports to the internet with a specific set of whitelisted IPs?</p>
  
Tags: <amazon-web-services><security><networking>
Title: AWS Inspector "High Risk" : port open to the internet with IP whitelisting
UserDisplayName: Konrad
ThreadText: # AWS Inspector "High Risk" : port open to the internet with IP whitelisting
  
  (Asked by: username_0 on 2021-03-10)
  
  We use AWS Inspector to identify risks with our AWS assets. Today I received a finding, with a "high" severity. The finding said that the FTP port was open to the internet. However, after reviewing the security group associated with the instance, I saw that the FTP port is only open to a set of whitelisted IP addresses that are trusted.
  
  Does this really constitute a high severity in your opinion? Is it problematic to open ports to the internet with a specific set of whitelisted IPs?
  
  **Tags:** amazon-web-services, security, networking
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-03-10. Score: 2 | Accepted answer
  
  If it is FTP (and not FTPS) then yes, it is a high severity risk. You are sending unencrypted traffic over the open internet. Even if you are whitelisting specific IP addresses, the traffic is still unencrypted between those specific instances.
  
  In addition, FTP is a very old (created in 1971) and non-secure protocol. It is not meant to be a secure method of transferring files. I recommend you research some of the security concerns with FTP and switch to either FTPS or more preferably, use a more native AWS approach for transferring files between instances. If your organization is under any regulation (FEDRAMP, HIPPA, etc.), using FTP across the open internet will not meet the compliance requirements.
  
  > **Comments:**
  > **username_0**: Ahh. I understand the issue better now. I don't actually use the FTP port, I just haven't run a thorough check of the ports for which my IP is whitelisted. But obviously, AWS does not know that.  
  
  ---
  
  