Security finding
Internet scan data shows hosts, open ports or expired certificates you may not know about
Security Warning Severity: Medium
Part of the audit External attack surface. Finding id: security.attackSurface.
What it costs you
What the scan data shows us, it shows everyone who buys it.
What to do
Decide for each host whether it is still needed. Close what is not needed and put the rest behind a firewall or VPN.
What it checks
- Unknown servers and sites linked to you
- Network ports open to the internet
- Expired certificates on forgotten servers
How to fix it
Close the port or put it behind a firewall
- If the service must stay: allow port [port] only for the addresses that need it, in the firewall of the host or the cloud provider.
- Reach databases and remote desktops through a VPN or an SSH tunnel, not directly.
- If nothing needs the service, stop it.
How to check: nc -vz [host] [port] (run it on a network outside your own; expect a refused connection or a timeout)
Find the owner of the host
- Find the owner of [host] inside the organisation and add the host to the account.
- If there is none, shut the server down and delete its DNS record.
- Renew or remove an expired certificate on a host you keep.
How to check: The host is in the account with an owner, or dig +short [host] gives no answer.
A real case
A study of certificate transparency logs found millions of websites still offering an expired certificate, and those hosts more often ran software with known flaws: 69% against 49% in a comparison group for one Apache flaw.