In practice
A firewall protects the company network against unwanted access from outside. When that firewall is working properly and attacks are being blocked, security appears to be in order. Yet this does not tell the whole story about the risks an organisation faces. A firewall can do exactly what it has been configured to do while certain systems remain directly accessible from the internet.
That became clear during an investigation Malenco carried out into network traffic in a production environment. The firewall was stopping unwanted traffic and blocking attempts to attack a web server. But a closer analysis of the traffic data revealed a much more serious problem: three machine control systems were directly accessible from the internet and were constantly being contacted by unknown parties.
This external access served a practical purpose. Employees needed to be able to access the machines from outside the organisation too. However, what was intended to make their work easier meant that the operator panels were accessible not only to authorised users, but also to anyone on the internet. The security measures in place were functioning in their own right, yet the way the environment had been configured left a risk that could have serious consequences for business operations.
What the firewall actually showed
The investigation was prompted by a need for better insight into network traffic. Malenco analysed three days of firewall traffic logs. The analysis considered not just blocked attacks, but also, crucially, connections that the firewall allowed.
That distinction matters. Many organisations trust a firewall to stop dangerous traffic. But a firewall primarily enforces the policy configured on it. When a connection is allowed, whether intentionally or unintentionally, that does not automatically mean the connection is safe.
In the environment under investigation, three operator panels for industrial installations were found to be directly accessible from the internet. Employees used this facility to access the machines remotely. External access was also relevant for maintenance and support by specialist providers.
That need is understandable. In modern production environments, being physically present at an installation is not always practical or necessary. Remote operation or monitoring enables employees to respond more quickly and makes support easier to arrange. But there is a fundamental difference between making machines remotely accessible to authorised users and exposing their operator panels directly to the public internet.
The analysis showed that, in just three days, the three machine control systems had been contacted more than a million times from over 950 different internet addresses. The attempts originated in various countries and took place almost continuously. The traffic pattern indicated automated attempts to gain access.
One machine control system also showed an unusual session. Whereas failed login attempts exchanged very little data, this connection involved considerably more data being sent. That pattern was consistent with a potentially successful login during which the operator screen may have been viewed.
The firewall logs could not establish that unauthorised access had actually occurred. Further investigation of the machine control system itself was needed for that. However, the anomaly was serious enough to be treated as a potential security incident until the situation had been clarified.
A practical facility with business risks
For a business owner, the most important question is not which network protocol makes a machine accessible. It is what someone could do with that access.
Unauthorised access to an industrial machine control system can have consequences that directly affect production. Someone who takes over the operator panel may be able to change settings or influence how an installation operates. This could result in downtime, equipment damage or unsafe situations.
What makes this situation distinctive is that the external access existed for a reason. It met the needs of employees and possibly maintenance providers too. From the user's perspective, the solution worked: the machines were accessible when needed. But that did not establish whether the chosen access method was appropriate from a security perspective.
This is a recurring issue in IT management. A facility is put in place to solve an operational problem. As long as it works, there is little reason to revisit the original decision. Meanwhile, risks change, and systems accessible from the internet are constantly probed by automated attacks. The question, therefore, is not whether employees should be allowed to access the machines remotely, but how that access can be organised securely.
Keeping access while improving its security
Malenco recommended closing the direct connections to the machine control systems as soon as possible. This did not mean that employees and suppliers had to lose their ability to access the systems remotely.
The proposed solution was to route external access through a secure connection, for example a dedicated industrial remote access environment or a VPN with individual accounts and additional authentication.
This changes the underlying approach. The machine control system is no longer directly accessible to everyone on the internet. Only users who sign in through the secure access method can then reach the systems they are authorised to access.
Malenco also recommended changing the passwords of the systems concerned and having the unusual session investigated further. It was also necessary to establish whether the suspicious connection might have originated from a legitimate party.
The investigation identified other areas for improvement as well. Some connections to servers were more broadly accessible than necessary, some firewall rules appeared to be no longer in use, and some equipment was communicating with external systems in an unusual way.
None of these findings was as urgent as the directly accessible machine control systems. Taken together, however, they showed why periodic reviews of network traffic and firewall configurations are valuable. An IT environment changes constantly. Employees adopt new ways of working, suppliers set up connections, and systems take on different functions. Access that was once necessary may later become redundant or undesirable. If no one assesses those changes together, risks can persist unnoticed.
The value of an investigation lies in what it reveals
This real-world case illustrates an important difference between having security measures in place and actually managing security risks. The firewall was present, working and blocking unwanted traffic. Yet the analysis revealed that part of the environment was exposed to a serious risk. That did not become apparent simply by checking whether the firewall was active, but by investigating which connections were actually taking place and why they were allowed.
This involves more than technology alone. The analysis needs to be translated into questions that matter to the organisation. Which systems are accessible from outside? Who needs that access? Who authorised it? Is the chosen access method still appropriate from a security perspective? And what would it mean for business operations if someone abused that access?
For the organisation concerned, the investigation resulted in specific recommendations setting out priorities, responsibilities and proposed measures. The most urgent risks needed immediate attention; other improvements could be made during routine maintenance. After the key measures had been implemented, Malenco recommended carrying out a similar traffic analysis again so that the effect of the changes could also be checked.
Whether all the recommended measures have since been implemented is outside the scope of the investigation's findings. What the analysis did establish was that a serious risk existed which might have remained unnoticed without this focused review.
Good IT management looks beyond the settings
For many businesses, it is taken for granted that employees and external suppliers need remote access to systems. This applies not only to production installations, but also to business applications, technical facilities and other parts of the IT environment. That access needs to be practical. But it also needs to fit within a security policy that clearly defines who has access, what it is used for and how it is monitored.
Responsibility for this cannot be left entirely to individual suppliers or users. They primarily focus on their own work. The organisation needs someone who maintains an overview and can assess the consequences for the entire IT environment. That is the role Malenco fulfils through professional, security-focused IT management. It means not only keeping systems working, but also investigating whether the way they work is appropriate from a security perspective.
A firewall that works properly is valuable. But real insight into an organisation's security only emerges when the connections it allows are reviewed as well.
