Priority action plan
The fastest way to raise your grade — grouped and ordered by severity. Work top-down.
1Lock down Windows file-sharing (SMB/NetBIOS)high2 devices
If reached from the internet or a compromised device, attackers can access shares, harvest credentials, or spread ransomware laterally (e.g. WannaCry).
- Confirm the device is NOT reachable from the internet (no port-forward for 445/139).
- Disable SMBv1 (legacy and unsafe); keep the OS fully patched.
- Require a password on every share and remove guest/anonymous access.
Affects: fileserver.lan :445ws-eng-01.lan :445
2Put remote desktop behind a VPNhigh1 device
Exposed to the internet they are relentlessly brute-forced and are a leading ransomware entry point; weak/no passwords mean instant takeover.
- Never expose remote desktop directly to the internet — put it behind a VPN.
- Require a strong, unique password and enable multi-factor auth where possible.
- For RDP, require Network Level Authentication (NLA).
Affects: ws-eng-01.lan :3389
3Restrict database ports to the LANmedium1 device
Open databases are continuously scanned by bots and are routinely dumped, encrypted, or wiped for ransom.
- Bind the database to localhost or your LAN only — not 0.0.0.0.
- Require authentication with a strong password; disable default/blank accounts.
- Never forward the database port on your router.
Affects: fileserver.lan :3306
4Keep Windows RPC off untrusted networksmedium1 device
Exposed to the internet it becomes an enumeration and exploitation surface for Windows services.
- Confirm your router does not forward port 135.
- Keep Windows fully patched.
- Block 135 at the firewall for any untrusted network.
Affects: ws-eng-01.lan :135
5Harden SSH if it's internet-reachableinfo2 devices
If reachable from the internet with password auth, it will be continuously guessed against; a weak password eventually falls.
- On a LAN this is generally fine.
- If internet-reachable, use key-based auth and disable password login.
- Consider a non-default port or placing it behind a VPN.
Affects: gateway.lan :22fileserver.lan :22
6Keep printers on the LAN and patchedinfo1 device
Exposed printers can leak queued documents, be defaced, or serve as a quiet foothold for an attacker to pivot.
- Keep printers on your LAN only.
- Update the printer firmware.
- Change the default admin password on its web panel.
Affects: printer.lan :9100
Exposures by device
fileserver.lan192.168.1.10
445highSMB file sharing (worm/ransomware target) not validatedFix: Make sure this device isn't reachable from the internet. Disable SMBv1, require a password on shares, and keep the OS patched.
3306mediumMySQL database not validatedFix: Bind the database to localhost or your LAN only, require a password, and don't forward this port on your router.
22infoSSH remote management not validatedFix: Fine on a LAN. If reachable from the internet, use key-based auth (disable passwords), and consider a non-default port or VPN.
ws-eng-01.lan192.168.2.15
445highSMB file sharing (worm/ransomware target) not validatedFix: Make sure this device isn't reachable from the internet. Disable SMBv1, require a password on shares, and keep the OS patched.
3389highRDP remote desktop not validatedFix: Never expose RDP to the internet. Put it behind a VPN, require Network Level Authentication, and use a strong/unique password + MFA.
135mediumMSRPC endpoint mapper not validatedFix: Normal on Windows LANs, but should never face the internet. Confirm your router isn't forwarding 135 and the host is patched.
gateway.lan192.168.1.1
22infoSSH remote management not validatedFix: Fine on a LAN. If reachable from the internet, use key-based auth (disable passwords), and consider a non-default port or VPN.
printer.lan192.168.1.20
9100infoPrinter raw/JetDirect not validatedFix: Keep printers on your LAN only and update their firmware. Exposed printers can leak documents and be used as a pivot.