Fileserver{pluralsuffix} exposed - {name}
What has been found
Fileserver{pluralsuffix} exposed - {name}.
A fileserver exposed to the internet is an attractive target for ransomware deployment. These protocols are rarely appropriate to be exposed to the internet.
Why this is a potential risk
Internet-exposed fileservers present an attractive target for ransomware, data exfiltration, and unauthorised access. Protocols such as SMB, NFS, or FTP, when publicly accessible, bypass internal security controls and allow attackers to exploit known vulnerabilities. Best practice is to restrict these services to trusted internal networks or controlled remote access solutions.
Potential solutions/Improvements
-
Eliminate unnecessary exposure: Confirm if the fileserver needs external access. If not, block all internet access immediately. Fileservers rarely need direct internet exposure.
-
Use secure alternatives: If external access is required, replace direct exposure with cloud-based file sharing solutions or a secure file transfer service (SFTP, HTTPS web portals, or managed cloud storage).
-
Access restrictions: Restrict access to trusted networks or authenticated users via VPN, zero-trust network access (ZTNA), or firewalled jump hosts.
-
Strong authentication and encryption: Enforce multi-factor authentication (MFA), strong passwords, and encrypt all data in transit and at rest. Disable insecure protocols like SMBv1, FTP, or unencrypted NFS.
-
Patch and harden: Keep the operating system, file server software, and associated applications up to date. Apply vendor hardening guides (e.g., Microsoft security baselines for Windows file servers).
-
Logging and monitoring: Enable detailed audit logs, monitor for abnormal access patterns or mass file activity, and alert on failed logins or suspicious behaviour.
-
Backups and recovery: Maintain offline, immutable backups. Test restore procedures to ensure ransomware or data loss events can be recovered quickly.
-
Periodic testing: Conduct external vulnerability scans and internal penetration tests to verify no unintended exposure exists and that access controls are enforced.
How to verify it is resolved:
- Perform an external vulnerability scan to ensure the server is no longer exposed.
- Review firewall and access control settings to confirm restrictions are in place.
- Ensure that access, if required, is secured with strong authentication and encryption.
- Regularly monitor logs for unauthorised access attempts.