Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Harden internet-facing devices by first finding every asset reachable from outside, removing exposure that has no operational purpose, and then protecting the systems that must remain public. Change default credentials, patch supported software and firmware quickly, replace products that no longer receive security updates, keep administration on trusted networks, separate public services from internal systems, disable weak protocols, and continuously scan and monitor for changes.
What internet-facing hardening protects against
An internet-facing device or service accepts traffic from outside your organization. Examples include web servers, DNS and mail servers, VPN gateways, remote-access services, cloud endpoints, network appliances, cameras, industrial gateways and management consoles. Any reachable listener can become an entry point when it has a vulnerable version, a weak password, an unsafe configuration or an access path into more valuable systems.
CISA describes the problem plainly in its Internet Exposure Reduction Guidance, published June 4, 2025: “Many organizations unknowingly leave common vulnerabilities and weaknesses exposed to the internet, making them easy targets for exploitation.” The practical objective is not to make every device unreachable. It is to ensure that only justified services are reachable, that each one is supported and securely configured, and that a compromise cannot spread freely.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Build a complete external inventory
Start with an authorized view from outside your network. Internal asset lists routinely miss forgotten appliances, temporary cloud systems, old remote-access portals, development services and devices installed by another team. Treat the resulting list as an exposure inventory, not as a vulnerability report.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to record for each exposed asset
- Public IP address, hostname and DNS records.
- Device, operating system, application or firmware name and version.
- Listening ports, protocols and externally visible interfaces.
- Business owner, technical owner and the system or data it can reach.
- Purpose, users, geographic scope and whether public access is actually required.
- Support status, patch process, maintenance window and recovery method.
- Authentication method, administrative path, logging and monitoring coverage.
- Dependencies such as identity services, databases, payment systems or control networks.
Use your authorized asset-management and vulnerability-scanning systems, perimeter logs and cloud inventories. CISA also identifies its Cyber Hygiene Vulnerability Scanning service and visibility resources such as Thingful, Censys, Shodan and Shadowserver as possible inputs. These services help discover exposure; they do not prove that an asset is safe or automatically remediate it. Confirm ownership and business impact before changing anything.
Validate the inventory safely
- Establish written authorization and a scanning window, especially for fragile or operational-technology environments.
- Compare external scan results with DNS, firewall, load-balancer, cloud and procurement records.
- Investigate every unknown address, hostname, port or certificate. A “mystery” service is an ownership problem as well as a security problem.
- Check whether a public address is a reverse proxy, NAT rule or shared service. Removing the wrong rule can interrupt several applications.
- Record the baseline date and repeat the discovery process after major network, cloud or supplier changes.
2. Decide which exposure is justified
For every reachable service, ask what business purpose requires internet access and whether the same purpose can be met with a narrower path. CISA recommends determining which assets need to remain accessible and restricting or removing access where it is unnecessary. Review dependencies before decommissioning or filtering a service that supports essential operations.
Use this exposure decision framework
| Question | If the answer is “yes” | If the answer is “no” |
|---|---|---|
| Does an identified customer, partner or employee function require public reachability? | Document the user group, service owner and required ports. | Remove the public route or firewall rule after dependency checks. |
| Can access be limited to known networks, identities or a VPN? | Use allowlists, private connectivity or authenticated access instead of open exposure. | Apply compensating controls and document why broad reachability is necessary. |
| Is the device supported and able to receive timely security updates? | Put it on a defined patch and replacement schedule. | Remove it from the internet or replace it; unsupported exposure is a standing risk. |
| Can administration be separated from the public service? | Place management on a trusted network or monitored jump host. | Do not expose the management interface merely for convenience; redesign the path. |
| Can the organization monitor and respond to its traffic and alerts? | Define alert owners, retention and an incident procedure. | Reduce exposure until monitoring and response are in place. |
“Public” should not be the default for convenience. A service used by a small group may be reachable through a private connection, a tightly restricted remote-access gateway or an identity-aware access policy instead. Record the decision, its owner and a review date so temporary exceptions do not become permanent.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute3. Harden systems that must remain public
Replace default credentials and strengthen authentication
Change vendor-supplied usernames, passwords, community strings and shared secrets before a device is connected to an untrusted network. Use unique credentials for each device and administrator, store them in an approved password manager, and remove dormant accounts. Require MFA wherever the authentication system supports it, particularly for administrative and remote-access paths. MFA reduces the value of a stolen password but does not patch a vulnerable service or prevent every form of exploitation.
A hardware security key can be an optional MFA implementation when the identity provider, VPN and organizational policy support it. The cited guidance does not mandate a particular key standard or product, so verify compatibility and recovery procedures before deployment. Keep emergency accounts protected, monitored and used only under a documented break-glass process.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Patch exposed software and firmware promptly
Maintain an inventory of versions and support dates, subscribe to vendor and government security advisories, test updates where operationally necessary, and prioritize internet-facing systems—especially vulnerabilities known to be exploited. Patch the operating system, web server, VPN appliance, firewall, management plane, plugins and firmware, not just the application that users see.
When a patch cannot be applied immediately, reduce exposure with access controls, a temporary shutdown, a protected jump host or another documented compensating control. Do not treat a workaround as a permanent substitute for updating. CISA’s ransomware guidance specifically warns against exposing services such as RDP directly to the web; if an exceptional business need requires exposure, use strong compensating controls and active monitoring.
Recommended Free Tools
Retire unsupported devices
End-of-support hardware and software may have no security fixes, even when the device still appears to work. Schedule replacement before the support deadline, migrate configurations and certificates, test rollback, and remove the old public route after cutover. If replacement is delayed, isolate the system behind a firewall, restrict its source networks, remove unnecessary services and monitor it closely while a funded retirement plan is completed.
Restrict traffic with least privilege
Use firewall rules, access-control lists, security groups or equivalent controls to allow only required source networks, destination ports and protocols. Separate user traffic from administration. Avoid broad rules such as “any source to any port”; make exceptions explicit, time-bounded and owned. Review both inbound and outbound paths because a compromised public device can use unrestricted egress to reach internal systems or external command infrastructure.
Use a monitored jump host for administration
Administrators should connect from trusted devices on trusted networks to a hardened jump host, then reach the device through a management channel that is logged and monitored. Keep the jump host patched, restrict who can use it, require MFA, record administrative activity where policy permits, and alert on unusual login times, sources or commands. Do not publish a device’s web console, SSH service or other management interface simply because the jump host is inconvenient.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Keep management interfaces private
Management interfaces have powerful privileges and are frequent targets. CISA’s network-device guidance says to manage devices only from trusted devices on trusted networks. Disable internet-routable administration where possible and bind management services to a dedicated management network, private address or restricted access policy.
Federal Civilian Executive Branch agencies have an additional requirement under Binding Operational Directive 23-02: remove exposed management interfaces or protect them with separate zero-trust policy enforcement. That directive is binding on those agencies; it is not a universal legal requirement for every organization. CISA recommends that other stakeholders review and adopt the security principles where appropriate.
Management-path checklist
- Remove public DNS records and NAT rules for administrative consoles unless a documented exception exists.
- Allow management only from approved administrator networks, devices or identities.
- Use a separate policy decision and enforcement path from the public application where feasible.
- Require MFA and individual accounts; prohibit shared administrator credentials.
- Log successful and failed access, configuration changes and privilege changes.
- Test that the management interface is not reachable over IPv4, IPv6, alternate ports or a forgotten secondary interface.
5. Limit blast radius with network architecture
Use a DMZ for public services
Place externally facing DNS, web and mail servers in a demilitarized zone rather than on the same unrestricted network as employee endpoints, identity systems or databases. Permit only the flows each public service needs. A web server may need a narrowly defined connection to an application tier; it should not have unrestricted access to workstation networks or the management plane.
Segment device groups
Separate servers, user endpoints, network infrastructure, cameras, building systems and other device groups according to their function and risk. Use firewalls or equivalent controls between segments, and restrict east-west traffic as well as internet ingress. Segmentation is valuable only when rules are maintained; periodically remove obsolete routes and test that a compromised device cannot traverse them.
Protect industrial and control systems
For ICS and other control environments, minimize network exposure and keep systems off the internet whenever possible. Place them behind firewalls, isolate them from business networks and provide controlled remote access only when required. VPN products used for this purpose also need prompt updates, minimized exposed ports and features, strong cryptography and careful monitoring; a VPN is not automatically safe merely because it is a VPN.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
6. Disable unnecessary and unsafe services
Every enabled listener increases maintenance and attack surface. Remove services that are unused, no longer supported or required only for temporary troubleshooting. CISA’s communications guidance gives these examples of services and protocols to disable when unnecessary:
| Service or protocol | Why it warrants review | Safer action |
|---|---|---|
| Telnet | Plaintext remote administration exposes credentials and sessions. | Disable it; use a securely configured, current administrative protocol through a private management path. |
| FTP | Traditional FTP can expose credentials and data in transit. | Disable when not required and replace with an approved secure transfer method. |
| TFTP | Provides minimal authentication and is often unnecessary outside tightly controlled workflows. | Disable or restrict it to a dedicated, isolated requirement. |
| SSH version 1 | Obsolete protocol version with weaker security properties. | Disable version 1 and keep the supported implementation patched. |
| HTTP administration or servers | Unencrypted web traffic can expose sessions and credentials. | Disable plain HTTP where possible; redirect or restrict access to a securely configured encrypted service. |
| SNMP v1/v2c | Community strings and protocol behavior can expose management information. | Disable when unused and restrict any required monitoring path with ACLs and current secure settings. |
Do not disable a protocol blindly on a production or control system. Confirm dependencies, test in a maintenance window and document the rollback. For required services, keep them fully patched and protected by narrowly scoped ACLs.
7. Harden VPN gateways and remote access
Remote-access gateways are internet-facing devices, not trusted tunnels by default. Minimize the number of exposed ports and features, disable unused algorithms and functions, use strong cryptography supported by the product, require MFA where available, and restrict administrative access separately from user access. Keep the gateway and its clients current because VPN products themselves can contain exploitable vulnerabilities.
Review who can connect, from which countries or networks where appropriate, at what times and to which internal segments. Give remote users the minimum network access needed for their task rather than placing every connection on a flat internal network. Monitor authentication failures, impossible travel or unusual source changes, new administrative sessions and sudden increases in data transfer.
8. Monitor, scan and reassess continuously
Exposure changes whenever a cloud resource is created, a firewall rule is copied, a certificate is renewed, a vendor opens support access or an old system is forgotten. CISA calls for routine assessments. Make the following activities recurring rather than one-time projects:
- Scan from an external perspective for new addresses, ports, services, certificates and management interfaces.
- Run authenticated vulnerability assessments where safe and authorized, then validate critical findings with the owner.
- Review firewall, ACL, VPN, cloud-security-group and DNS changes.
- Monitor ingress and egress traffic for unexpected sources, destinations, protocols, volumes and timing.
- Centralize authentication, configuration-change and security-device logs with useful retention.
- Prioritize remediation of known exploited vulnerabilities and internet-facing misconfigurations.
- Recheck after every major network, cloud, supplier or application change.
Define service-level targets for exposure findings, assign an accountable owner and verify closure with a new scan. An alert without an owner or response playbook is not an effective control.
9. Respond when an exposed device is compromised
Have a decision path before an incident occurs. If an internet-facing device shows signs of exploitation, preserve relevant logs and evidence, restrict or remove its external access, and prevent it from reaching unnecessary internal systems. Rotate credentials and certificates that may have been exposed, inspect neighboring systems for lateral movement, and rebuild or replace the device when integrity cannot be trusted.
Quick Recap
- Confirm the affected asset, owner, exposure and time window.
- Apply the safest containment available: remove the public route, block malicious sources, isolate the segment or shut down the service.
- Preserve logs, volatile evidence where feasible and configuration history.
- Determine whether credentials, tokens, keys or sensitive data were accessed; revoke and replace them as needed.
- Patch or rebuild from a trusted image, then validate configuration and monitoring before restoring service.
- Review why the asset was exposed, update inventory and controls, and test for similar exposure elsewhere.
10. Common hardening mistakes
- Assuming a scan equals security: Discovery reveals what is visible; it does not establish safe configuration, patch status or ownership.
- Leaving administration on a public address: A strong password does not justify an exposed management plane.
- Using a VPN as a complete solution: The gateway still needs patching, MFA, restricted access, strong cryptography and monitoring.
- Keeping unsupported equipment online: Isolation can reduce risk temporarily, but replacement is the durable fix.
- Allowing broad egress: A compromised public host can use unrestricted outbound access to attack other systems or communicate externally.
- Disabling a service without dependency review: An abrupt change can interrupt essential operations; test and document the change.
- Treating MFA as a patch: MFA helps protect authentication, but it does not correct an exploitable service or firmware flaw.
- Failing to retest: A secure baseline can be undone by one new cloud resource, rule or vendor connection.
Implementation checklist
- Inventory every internet-reachable address, hostname, port and service.
- Assign an owner and business purpose to each exposure.
- Remove public access that is not operationally necessary.
- Change defaults, remove dormant accounts and enable MFA for administration and remote access.
- Patch supported systems promptly, prioritizing known exploited vulnerabilities.
- Replace devices and software that no longer receive security support.
- Move administration to trusted networks and a monitored jump host.
- Place public DNS, web and mail services in a DMZ and segment internal systems.
- Keep ICS and control systems off the internet and behind firewalls wherever possible.
- Disable Telnet, FTP, TFTP, SSH v1, plaintext HTTP and SNMP v1/v2c when they are not required.
- Minimize VPN exposure, disable unused features and algorithms, and keep gateways current.
- Monitor ingress and egress traffic, centralize logs and assign alert responders.
- Repeat external discovery, vulnerability scanning and configuration review as the environment changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
