How can I handle open ports?

Question

After port scanning my company's network, I found a lot of open ports. What are the risks that will result out of these ports, if I left them open? And is there any way to handle them without closing them?

Answer 1

What are the risks that will result out of these ports, if I left them open?

As a security good practice, ports should be open only on a need-to-be basis. You are exposing the services that are listening on those ports you left open to exploits. Why? Because a service means something is processing data and thus you are also exposing the vulnerabilities of the applications using those ports.

For example if you let your FTP port open to every one without any restriction rules (firewall) then a hacker could load lot of porn videos to consume lot of space of your server which thing will lead for example to very slow connection to your FTP service. Also lot of ports open expose you more to Trojan Ports.

This schema summarizes better the answer to your question:

And is there any way to handle them without closing them?

• Yes, you can leave those ports open but under the condition you have to limit what is allowed to listen on them: that is the job for firewalls. For example, on port 21, allow only the IP address of your home office or home to connect to it and no one else.
• You can leave them open and setting all the closed ones to stealth.
• If you can change a port's number then do it. For example if you can modify the port 21 (FTP) to a higher one (3737 ?), that can lead the hacker to go away because he would start to scan common ports (20, 21 ...) and since port scan takes time, he could be impatient to wait until the scan performs over the 3737 port.
• Use free services that could help you such as this free firewall and from time to time CanYouSeeMe.

Answer 2

The biggest risk for you is that your company network security detected your portscan. It is a security attack and their countermeasures probably don't consider your wish to remain in your job seriously.

The biggest risk for the company is that a list of numerous open ports means elevated attack surface. Attacking something is a hard thing, but if there are a lot of them, earlier or later an attacker will find his way to get in.

Answer 3

Open ports are like unlocked doors. The risk depends on what you have in those rooms. If you have some money on a table, then the risk is high. If you have money in a safe, then the risk is medium. And if the safe is bolted to the wall, then the risk is low.

You can close the services behind those ports or you can use a firewall to control or block access to them. It is difficult to manage each host and service, so it is a general practice in companies to put hosts behind a firewall or NAT device. This way, they are not open to access on the internet so risk is reduced because, theoretically, only persons with internal access to the network have access to those hosts and services.

Establishing a security perimeter like this is gradually becoming an ineffective security policy. That is because the security perimeter is becoming porous. New technologies and vulnerabilities allow attackers easy and unexpected access to the internal network. A compromised mobile phone might join the network or an employee might get infected by browsing a malicious website and therefore compromise the perimeter.

As for your question of handling them, there are several ways of reducing the risk, some proactive and some reactive. Segment your network further so certain hosts are not accessible from all the other hosts. A computer in the accounting department should not be accessible without restrictions from any other computer in the company. The reactive method is to log and analyse access inside the company network. This would hopefully deter employees from accessing things that they should not and detect attacks from the outside of the company. This is not bullet proof and would not be effective in a large company.

Answer 4

An open port as such is not a security risk. The security risk, if any, is with the service behind the port. The worst case is a port left open unintentionally, because it exposes a service that wasn't meant to be exposed and consequently might not be secured properly.

So the way to deal with the list of open ports you found is:

1. Check it against your list of ports that should be open, ie. the services you want to offer.
2. Close the ports that should not be open.
3. Verify that the services behind the open ports are properly secured as mandated by your security policy.