Always run Elasticsearch behind an auth proxy like nginx or their Shield offering.