Skip to main content
Every open port on an internet-facing system is a way in. Some have to be open, like HTTPS on a web server. Many are left open by accident, and those are what attackers scan for.

​
What ports are

A port is a numbered endpoint on a device, and each one is tied to a service. Port 443 carries HTTPS web traffic, port 22 carries SSH, and so on. A Telivy External Assessment or Risk Assessment lists the ports on a company’s systems that can be reached from the internet.

​
Why open ports are a risk

Each open port is one more service an attacker can probe. The more ports are open, the more chances there are that one of them runs something vulnerable or misconfigured.
Attackers scan the internet for specific open ports and then try known exploits against the service running there. Unpatched software or an outdated configuration makes that much easier.
A vulnerable service on an open port can be used to install malware, which can lead to data theft or an attacker taking control of the device.

​
High-risk ports: close unless needed

Windows uses it to locate RPC services and for legacy NetBIOS name resolution. It is a common target for remote exploits and worms. Restrict it to trusted networks, or turn it off if nothing needs it.
Gives remote access to a Windows desktop. If it has to be reachable, put a VPN or a dedicated remote access tool in front of it, and require strong passwords.
Used to connect to a database. Avoid exposing them to the internet. If you must, enforce access controls, strong passwords, and MFA.

​
Medium-risk ports: use with caution

Used for file and printer sharing on older Windows systems, and often abused by malware to move between machines. Turn them off if they aren’t needed, or limit them to trusted internal networks.

​
Low-risk ports: lower priority, still worth reviewing

Transfers files without encryption. Telivy rates an open FTP port as low severity, but it’s still worth replacing with SFTP (22) or FTPS (990).
Remote access without encryption. Telivy rates it low severity, but SSH (22) is the safer choice.

​
How Telivy scores open ports

In an External Assessment, each open port Telivy finds is matched against the lists above and gets that severity (high, medium, or low), based on the service most commonly associated with the port. A Risk Assessment, which scans devices through the agent, works differently. Open ports found on a device are reported together as a single Device Open Ports Detected finding with one severity, instead of being scored port by port. Some common ports aren’t in the severity lists at all. SSH (22), DNS (53), HTTP (80), and HTTPS (443) are expected to be open on most servers and aren’t flagged as open-port findings on their own. SMTP (25) is checked separately: Telivy looks at whether the mail service uses SSL/TLS encryption and reports missing encryption as its own finding.

​
How to close unused ports

How you close a port depends on the device or firewall. Start with the list of open ports from the Telivy scan. For each one, work out which service is listening and whether anyone still needs it. If not, stop the service or block the port at the firewall. If it is needed, restrict who can reach it, for example to a VPN or a list of trusted IP addresses. Ports opened for things like games or old VPN setups are worth checking too, since they are often forgotten once the reason for them goes away.