What is an exposed service?¶
An exposed service is a network or application service reachable from a wider or less trusted environment than intended.
Avoid the dangerous assumption¶
The dangerous assumption is that any internet-facing service is insecure or compromised.
It may be deliberately and legitimately public.
Examples include:
- remote desktop
- web applications
- VPN gateways
- file-transfer services
- email services
- databases
- administrative panels
- APIs.
The investigative question is whether the exposure was expected, protected and relevant to the incident.
Ask:
- which address and port were reachable
- what service and version were running
- what authentication applied
- who controlled the configuration
- when exposure began
- whether the service was logged
- what requests or logins occurred.
An exposed service may increase opportunity for scanning, password attacks or exploitation.
It does not prove that an offender gained access.
Likewise, a service described as “internal” may still be reachable through a VPN, cloud route, gateway or compromised device.
Preserve firewall, gateway, application, authentication and configuration records.
Where possible, establish the historical exposure rather than relying only on the current state after containment.
Do not assume the apparent source IP identifies the controller. Automated scanning and attacks may come through distributed or compromised infrastructure.
Exposure may also be temporary. Cloud changes, port forwarding, emergency maintenance or automated deployment can make a service reachable only during a limited period, so preserve historical configuration and network records.
Historical reachability matters more than current appearance.
Operational takeaway¶
Establish what service was reachable, from where, under what controls and during which period before treating exposure as evidence of initial access.