NexusSec.Somewhere on your network there may be a device answering the internet that nobody remembers setting up: a camera recorder someone wanted to view from home, a test server from a past project, a firewall admin page opened for a supplier. Automated scanners find these long before you do, unless you look first.
Step 1: list what you own
- Public IP addresses on every internet connection, at every site, including backup links.
- Domains and subdomains you have registered, including old ones that still point somewhere.
- Cloud services: virtual machines, storage, and anything with a public address in AWS, Azure, Google Cloud or a hosting provider.
- SaaS and third-party services that hold your data and accept logins, such as your website's admin panel.
Step 2: find what you forgot
- DNS records. Review every record in your DNS zones. Old records often point to servers that were never switched off.
- Certificate transparency logs. Public certificate authorities log every certificate they issue, and search tools such as crt.sh let you look up all certificates for your domain. Hostnames turn up there that are not in anyone's list.
- Internet search engines for devices. Services such as Shodan and Censys continuously scan the internet and index what answers. Searching them for your own IP addresses shows what attackers see.
Step 3: check from outside
Scan your own public addresses from a connection outside your network, with a tool such as Nmap, to see which ports answer and what is listening. Only scan addresses you own or have written permission to test. Look especially for:
- Remote desktop and other remote administration ports.
- Firewall, router, switch and NAS administration pages.
- VPN portals, which should be expected, patched and protected with MFA.
- CCTV recorders and other devices reached through port forwarding.
- Databases, file shares and test or development servers.
Step 4: shrink the list
- Remove anything that does not need to be on the internet, and the port forward or firewall rule that publishes it.
- Move administration behind the VPN. Admin pages should not face the internet at all. See remote access for staff.
- Patch and protect what must stay: current firmware, MFA, and monitoring of its logs. Internet-facing devices go first in your patching routine.
- Retire old DNS records and cloud resources that point at nothing, so they cannot be taken over.
Step 5: keep checking
Exposure creeps back as people add port forwards and cloud services to solve immediate problems. Repeat the check every month, and after any change to the firewall or cloud setup. The goal is a short, confident list, the one every good IT supplier should be able to give you. Our network penetration testing and VAPT services include this external view, done independently.
Edge devices themselves have become a common way in, as covered in the firewall became the way in.
