What an attacker sees from outside

Before defending a network, look at it the way an attacker does. From the internet, your organisation is a set of IP addresses, each with ports that are open, closed or filtered.

Ports and services

A port is a number that identifies a service on a host: 443 for HTTPS, 22 for SSH, 3389 for Windows Remote Desktop, 5432 for PostgreSQL. A port is:

• Open when a service accepts connections on it.
• Closed when the host answers that nothing listens there.
• Filtered when a firewall drops the traffic and nothing answers at all.

Every open port is attack surface: a service with code, configuration and possibly vulnerabilities that anyone on the internet can reach.

Attackers scan everything

Automated scanners sweep the entire IPv4 internet continuously. Services such as Shodan and Censys publish what they find, so an attacker can search for every exposed instance of a vulnerable product without scanning anything themselves. If you expose a database, a remote desktop or an admin panel to the internet, assume it will be found within hours.

Your own view

With permission and only on systems you are responsible for, scan your public addresses the same way:

nmap -Pn -sS --top-ports 1000 203.0.113.10
nmap -Pn -sV -p 22,80,443 203.0.113.10

-sV asks services to identify themselves, which shows what software and versions you expose. Compare the results with what you intended to expose. The differences are your first findings.

Reducing attack surface

The most effective network security step is simply exposing less:

• Close or firewall everything that does not need to be public.
• Put administrative interfaces behind a VPN or an identity aware proxy instead of the open internet.
• Never expose databases, remote desktop or file sharing protocols directly.
• Keep an inventory of what is exposed and review it regularly, because cloud resources and test servers appear quickly and are easily forgotten.

Inside matters too

Once an attacker gets a foothold inside, for example through a phished laptop, they look around the internal network. If everything can talk to everything, they move freely. The rest of this course is about making both the outside and the inside harder to abuse.