CSIRT-IE Reports on Internet Accessible Protocols that should not be exposed in an uncontrolled manner.
Objective
CSIRT-IE primary focus, in regard to the following reports, is to report Internet Accessible protocols that should not be exposed in an uncontrolled manner. These Internet Accessible protocols may be exploited or abused to gain access to computer networks or systems. CSIRT-IE seek to identify protocols within the State that are Internet Accessible and that are exposed in an uncontrolled manner, and to inform responsible network operators and constituents, based upon the IP address of the affected server or system, by email and to provide advice and recommendations on how to reduce the threat posed by an Internet Accessible protocol that are exposed in an uncontrolled manner.
Source of Information
The Shadowserver Foundation is a Non-Governmental Organisation and one of the world's leading resources for internet security reporting and malicious activity investigation. The Shadowserver Foundation works with national governments, network providers, enterprises, financial and academic institutions, law enforcement agencies, and others, to reveal security vulnerabilities, expose malicious activity and help remediate victims. The Shadowserver Foundation performs a scan of the entire IPv4 internet every day for Internet accessible servers & services and reports the security vulnerabilities found. It has also participated in the SISSDEN EU Horizon 2020 project using SISSDEN'S Network of Honeypot Sensors to log unsolicited attack traffic which was directed at them. Information on Shadowserver Reports and the data contain therein can be found at Shadowserver Reports
Event Severity Levels
On the 12th Oct 2023, the Shadowserver Foundation introduced a new system of categorising events in their reports called Event Severity Levels, making it possible for recipients of their reports to filter events based upon the severity of the actual event reported. The Shadowserver Foundation have also commenced applying a default severity level to their reports.
| No. | Level | Description |
|---|---|---|
| 1. | Critical. | Highly critical vulnerabilities that are being actively exploited, where failure to remediate poses a very high likelihood of compromise. For example, a pre-authorisation Remote Code Execution (RCE) or modification or leakage of sensitive data. |
| 2. | High. | End of life systems, systems that you can log into with authentication that are meant to be internal (SMB, RDP), some data can be leaked. Sinkhole events end up in this category. |
| 3. | Medium. | Risk that does not pose an immediate threat to the system but can over time escalate to a higher severity. For example, risk of participating in DDoS, unencrypted services requiring login, vulnerabilities requiring visibility into network traffic (Man-in-the-Middle (MITM) attack without being able to manipulate the traffic) to exploit, an attacker will need to know internal systems/infrastructure in order to exploit it. |
| 4. | Low. | Deviation from best practice - little to no practical way to exploit, but setup is not ideal. Vulnerabilities requiring MITM (including manipulating the traffic) to exploit. |
| 5. | Info. | Informational only. Typically no concerns. However, this category includes the Device Identification report, which may include information on device types that should not be accessible on the public Internet, in which case the individual events in the report may be assigned higher severity levels. Review in accordance with the organisation security policy. |
Secure Information Sharing Sensor Delivery Event Network
The Secure Information Sharing Sensor Delivery Event Network (SISSDEN) seeks to improve the cyber security posture of EU organisations and citizens through the development of increased situational awareness and the effective sharing of actionable information. The SISSDEN project has received funding from the European Union's Horizon 2020 research and innovation programme.