The Security Dangers of Open Default Services on Firewalls

Sanjay Seth, P J Networks Pvt Ltd

I’m at my desk writing this post, third coffee fueling me, fingers itching at the keys to share what I’ve seen over the years. Since 1993, when I first got into the network side of things as a network admin slinging voice and data multiplexing across PSTN, I’ve been slowly breadcrumbing my way into the field of cybersecurity. The Slammer worm came crashing into networks like a wrecking ball, and I still have vivid memories of the chaos. Yeah, in some ways things have changed, and in others it remains just as persistently deadly as it ever was: the sane default of closing off every one of those open services on your firewall that no one really bothers to turn off.

I now own my cybersecurity firm, P J Networks, and recently assisted three banks with updates to their zero-trust architectures. And you want to talk about tight security? It begins at the firewall, people — and those annoying unused services? They are a standing invitation to mischief. Oh—and by the way—I just returned from DefCon (hardware hacking village!). My actual brain is still buzzing with all this, so be patient.

Common Open Services

Firewalls are not the gatekeepers, they are the bouncers. But at times, they also open the door to more than just the cool kids. Many firewalls come pre-loaded with a number of enable open services by default.

I’m talking about:

• Telnet (yes, the old dinosaur)
• FTP (old as dirt but still alive)
• SNMP (Simple Network Management Protocol, excellent for monitoring though a security risk when exposed)
• HTTP/HTTPS (obviously required but watch those management interfaces)
• NetBIOS
• DNS services
• Or even specific management protocols occasionally, like RDP or SSH on standard ports.

Now — here’s the kicker — most of these:

• Do not require them on day to day business.
• Sit quietly, unmonitored.
• The ripe targets for attackers.

In the early days, as a young network engineer, I was out managing mux devices over the PSTN, and the way to administer a device was over Telnet. But these days? But, having Telnet enabled on your firewall is like leaving your car keys in your vehicle and the doors unlocked, it is an invitation for access. Dumb move.

Why They’re a Risk

Here’s the other thing about these unused open services — they’re like those old, rusted backdoors in a house that is never used but no one thinks to lock.

Too often, these services:

• Full of outdated software with well-known defaults (seriously who remembers to change those?)
• Don’t support strong encryption (Telnet anyone? plain text passwords?
• Allow attackers easy footholds to enter the environment
• Can be abused by worms, ransomware, and other baddies within mere seconds.

I’ve been involved in cases where unused SNMP services on firewall appliances were abused to gain valuable network topology information. Have it in mind — attackers vectoring the battlefield ahead of striking.

And here is where the personal stakes come in: I once, early in my career, ignored an unused FTP service on a client’s firewall. It got exploited. I learned the hard way—no one forgets a mistake like that. Since then, our core focus has been on hardening firewalls and closing unnecessary services.

Zero-trust architectures? They want everything to get locked down. This means disabling every unnecessary port and service. All open doors are attack surface—and enough said on that front.

Closing Unused Ports

Now, this sounds like common sense, but you’d be amazed at how often that’s not done properly. Here’s how I’d go about this — informed by decades of scrubbing up networks:

1. Inventory what’s running. Every port, every service entry on the firewall config.
2. Ask the hard questions. Does your business need this service actually open? Not only can it be used, but it is necessary to be open?
3. Disable and monitor. Disabling the service or closing the port. Then observe for any access attempts or fallbacks to defaults.
4. Document everything. I know, documentation is not something sexy. But if your firewall config changes and you have no record, you are buried.

The banks we assisted had dozens of open ports that were just.. there We methodically closed them, strengthening the perimeter. Result? Fewer alerts, less false positive and a cleaner security posture.

Network Segmentation

Okay—shut down ports and services, but don’t stop there. The network is your castle; the walls inside matter as much as the moat outside.

With network segmentation, you can consider your network as divided into smaller, manageable zones all with their firewall rules and policies. Then, if an attacker makes it through one segment, they don’t get a free pass everywhere.

Practically, this means:

• Segregate backend systems (database, financial apps, etc.) from general users traffic.
• Segregate unmanaged devices or guests in air-gapped networks.
• Implement VLANs and firewall policies to limit cross-zone communication.

This was non-negotiable when working with banks that were upgrading to zero-trust. Each zone had meticulously defined access, no random services sitting around waiting for a hacker’s knock.

Reducing Attack Surface

The bottom line here is: For every open port that you do not need you increase your attack surface.

What’s an attack surface? Think of your network as a car. Every open service is like leaving a door or window open while you’re parked downtown. Open doors mean more opportunities for someone to sneak in and take your stuff.

This is PJ Networks’ approach to attack surface reduction:

• Turn off every unused service.
• Stay alert—conduct regular firewall audits
• Harden settings—for instance, require minimum password complexity (don’t get me started on how many still have “12345” running). No, really, password policies that don’t suck.
• Frequent updates and patches — not just the OS, but other firmware on firewalls and routers.
• Implement logging and alerts to detect suspicious activity, the sooner the better.

And it’s a personal pet peeve of mine: I’m really skeptical of any AI-powered security solution that promises to perform magic. Guess what? AI can assist — but there’s no substitute for good old firewall hardening, patching and good judgment.

Quick Take

Got no time to get bogged down in details? What you really should do is this:

• Review all active services on the firewall. If you didn’t consciously open it, close it. Period.
• Segment your network. Don’t put everything on a single flat network.
• Regularly patch and update all firewall and network gear.
• Configure management interfaces and SNMP, FTP, etc.
• Review logs for anomalous access attempts.

And, for Pete’s sake — don’t rest on your laurels just because you bought a next-gen firewall. Open services by default is still number one risk.

Wrapping Up

I’ve been in trenches that have seen entire networks driven to their knees by worms that used unused services on their firewalls (I’m looking at you, Slammer worm). It’s not nostalgia to note that we’ve come a long way, but the old habits die hard. Failing to disable default open services? That’s one we’ve got to kill, fast.

If you’re running a business or something else on your networks, now is the time to sit down and actually check your firewall configs. It’s like washing your hands before dinner — invisible, easy, but vital to your security health. All of us at P J Networks are getting ready to help organizations fortify their network gates — not only for regulatory compliance but also to help you rest easy at night.

So, turn the lights out in rooms you’re not using — close those doors tight. Your network — and your peace of mind — will thank you.

And now? Time for a fourth coffee.

---

Sanjay Seth
Cybersecurity Consultant & Founder
P J Networks Pvt Ltd
Servicing since 1993, imprisoned since 1967, processing.