Examples of policies on open ports

Alexander Matsson

Modified on: Tue, 24 Sep, 2024 at 1:01 PM

Exposing the wrong port on the open internet can be devastating for your organization's security. Detectify allows you to monitor this continuously across your full attack surface and to be notified as soon as something unwanted happens using Attack Surface Policies. In this article, we will explain some useful policies that cover open ports.

Monitor internal domains exposing open ports externally

Every organization has some domains that are not supposed to expose any open ports on the open internet, like if they are supposed to be behind a VPN. Detectify allows you to setup a policy to ensure that if any of these domains accidentally exposes an open port to the internet, you'll be the first to know about it. To create such a policy, simply set the scope of domains that should be covered with a filter on "Monitored domain", like in the example below, and then add a filter looking for any domain with the number of open ports being more than 0.

Monitor exposed open ports

The filter operators for open ports

There are five different filter operators to choose from when filtering on open ports. These are:

contain any of (A ⋂ B != ∅)
- This one adds an or between each value added to the list of values. This means that, if a domain has any of the ports listed open it will match. Think of this as a disallowlist and it will match anything that is using these disallowed ports.
do not contain any of (A ⋂ B = ∅)
- This filter also adds ors between each value but it will match if not any of those ports are found open on a domain.
contain all of (⊇)
- For this filter, an and is added between each value, such that it matches only if all ports listed are found to be open.
do not contain all of (⊅)
- This filter still uses the and between values but it matches only if not all ports listed are found open.
do not only contain (⊄)
- This one is a little special. It matches if a port is found open that is not listed in the values. You can think of this as an allowlist. It will match anything that is not using any of these allowed ports.