Skip to main content
A port is a numbered endpoint that a service on a computer listens on, so traffic for that service reaches the right program. A web server listens on 443, Remote Desktop on 3389, and so on. Opening a port is normal. The problem is a port that is reachable from the internet when it does not need to be, or one whose service is unpatched or badly configured.

​
How open ports get exploited

Attackers scan the internet all the time with tools like Nmap to find open ports and identify the service behind each one. When they find a service with a known vulnerability or weak authentication, such as Remote Desktop with a guessable password or a database open to anyone, they use it to get in. From there they can steal data, install ransomware, or move to other machines on the network.
Port scan output listing open ports and the services behind them

Example output from a port scan

An unnecessary open port can lead to unauthorized access, malware delivery, denial-of-service attacks, interception of traffic, and a foothold for moving laterally through the network. Exposed ports can also put a client out of line with frameworks such as PCI DSS that expect access to be restricted.

​
How Telivy rates open ports

Every External Assessment and Risk Assessment scans the client’s internet-facing addresses for open ports. Telivy puts the ports it finds into three risk tiers. High risk. Close these unless they are absolutely necessary:
  • RPC Endpoint Mapper / NetBIOS (135)
  • Remote Desktop (3389)
  • Databases (MySQL 3306, PostgreSQL 5432)
Medium risk. Restrict access and use with caution:
  • NetBIOS / SMB (137, 139)
Low risk. Lower priority, but still worth reviewing:
  • FTP (21)
  • Telnet (23)
Common service ports such as SSH (22), DNS (53), HTTP (80), and HTTPS (443) are not flagged as open-port findings on their own, because most servers are expected to have them open. SMTP (25) is checked separately: Telivy looks at whether the mail service uses SSL/TLS encryption and reports missing encryption as its own finding.

​
Remediation

  1. Find the open ports. Run an External Assessment or Risk Assessment to list the ports visible from the internet.
  2. Work out what each one is for. Identify the service behind every port and whether anyone still needs it. Start with high-risk ports.
  3. Close, restrict, or patch. Close ports nobody needs. For the ones that must stay open, limit access to known IP addresses or put them behind a VPN, and keep the service patched. Close open ports has step-by-step instructions.
  4. Rescan and record. Rescan to confirm the ports are closed, and note what you changed and why for future audits.
  5. Keep watching. New services get exposed by accident. Risk Monitoring rescans on a schedule and can alert you on new exposures through the Network / External Surface alert category.