Devices, segments and exposure

Summary

Every device an internal scan finds has its own card: what it is, how it was recognised and whether it can be reached from the internet. In this lesson you open a NAS card, read the fingerprinting evidence, browse the inventory by subnet and find an exposed operator panel.

The device card

In the scan, open Asset Inventory, search for the device (nas01 in the video) and open its row.

• Network details shows the Vendor, Model and operating system, the Role (for example Storage), the Confidence, the Posture, and the First seen and Last seen dates.
• Show deep-fingerprinting details opens the evidence: the posture causes (for example SMBv1 enabled and Deprecated TLS), the signals behind the operating system and role, each with its weight, and the Identification sources.
• Open Ports lists the services listening on the device.

The inventory by subnet

Once you close the card, Asset Inventory groups devices by subnet: each header shows the network and its host count, and you can collapse or expand each section.

Internet exposure

Turn on Show only internet-exposed assets to see only the devices reachable from outside, then open the row. The External exposure section shows the status and how it was established:

• Exposed (proven) with the method Verified live (active knock): during the scan RECON reaches the site's public IP from the internet and sends a scan-specific code on every open port; the probe sees that code arrive at an internal device. This is the strongest evidence: that device can be reached from the internet. This check runs when RECON knows the public IP the probe uses to reach the internet.
• Likely exposed with the method Fingerprint correlation: for an open public port, the fingerprint seen from outside (TLS certificate, SSH host key or favicon) matches exactly one internal device in the scan.
• Possibly exposed: matched by fingerprint, or seen through an internal relay. Reachability from outside is not independently proven.
• Not reachable from our vantage: RECON could not reach the device from the internet.
• Exposure undetermined: RECON could not tell from its vantage point (for example behind carrier-grade NAT). This is not a guarantee that the device is not exposed.

The card also shows the Public IP and the Reachable ports. Separately, a device can be marked Internet-connected: it reaches the internet outbound, which is not the same as being reachable from the internet.

Chapters

Key points

• Confidence measures how much evidence was collected; posture (A to F) measures how robust the configuration is.
• The posture causes tell you what to fix first on that device.
• The inventory by subnet shows at a glance how many hosts each segment holds.
• Exposed (proven) is evidence, not an estimate: an internal device, for example the panel that drives a production line, can be reached by anyone on the internet.
• The usual fix for a device exposed through port forwarding: remove the forward on the perimeter firewall and use a VPN for remote support.
• In the Risk tab, the Necessary Actions section lists the recommended actions for the scan.

Transcript

The full transcript of the video (in Italian) is in the player's Transcript tab.

Next steps