DigitalOcean network security checks
IP allow-lists, TLS, DNS and edge settings that keep the application reachable only from where it should be.
On DigitalOcean, Black Cat runs 7 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the DigitalOcean connector needs.
Checks (7)
severity: high No VPC fix difficulty: medium #
Move the Droplet into a custom VPC for network isolation
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > VPC and create a new VPC in the same region as the Droplet if one does not exist
- Navigate to Manage > Droplets and click the affected Droplet name
- In the Droplet detail view select "Networking" then click "Edit" next to the VPC section
- Select the target VPC from the drop-down and save the change
- Verify the Droplet's private IP reflects the new VPC subnet
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: critical No Firewall fix difficulty: medium #
Create a Cloud Firewall and attach it to the unprotected Droplet
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > Firewalls and click "Create Firewall"
- Define inbound rules allowing only required ports (e.g. TCP 22 from trusted IPs, TCP 443 from all)
- Define outbound rules as needed; restrict unrestricted outbound if possible
- Under "Apply to Droplets", add the affected Droplet by name or tag
- Click "Create Firewall" and verify the Droplet appears in the firewall's Droplets list
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Allows All Inbound fix difficulty: medium #
Restrict firewall inbound rules to trusted IP ranges and required ports only
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > Firewalls and click the affected firewall name
- Select the "Inbound Rules" tab
- Identify rules that allow all sources (0.0.0.0/0 or ::/0) on non-HTTP(S) ports
- Edit or delete those rules and replace with specific trusted IP addresses or CIDR ranges
- Save the changes and verify no broad inbound rules remain
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: critical SSH Open To All fix difficulty: medium #
Restrict SSH (port 22) inbound access to specific trusted IP addresses
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > Firewalls and click the affected firewall name
- Select the "Inbound Rules" tab
- Find the rule allowing TCP port 22 from 0.0.0.0/0 or ::/0
- Edit the rule and replace the source with specific trusted IP addresses or CIDR ranges
- Consider using a VPN or bastion host so only that IP needs to be allowed; save the changes
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: medium Allows All Outbound fix difficulty: medium #
Restrict firewall outbound rules to required destinations and ports only
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > Firewalls and click the affected firewall name
- Select the "Outbound Rules" tab
- Identify rules allowing all destinations (0.0.0.0/0) on all ports (All TCP/UDP)
- Edit or delete those rules and add specific destination IPs/CIDRs and required ports
- Save the changes and test that legitimate outbound traffic still works
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: critical Publicly Accessible fix difficulty: medium #
Add trusted source IP restrictions to the database cluster firewall rules
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Manage > Databases and click the affected database cluster name
- Select the "Settings" tab and scroll to the "Trusted Sources" section
- Click "Edit" and add the IP addresses, CIDR ranges, or Droplet/tag names that need access
- Remove any open entries (0.0.0.0/0) if present
- Save the changes and verify database connectivity from trusted sources
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: low Default VPC Used fix difficulty: medium #
Create a custom VPC and migrate resources away from the default VPC
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > VPC and click "Create VPC"
- Define a name, region, and custom IP range for the new VPC
- Assign existing resources (Droplets, databases, Kubernetes clusters) to the new VPC
- Update firewall rules and internal DNS references as needed
- Verify all resources are communicating correctly on the new VPC before decommissioning default VPC usage
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9