How does an attacker get from our public IP address into our internal machines?

Through a service that answers on that address, or through a person. Your public IP address on its own is not a door; the open ports behind it are. Attackers scan the whole internet for remote desktop, VPN gateways, firewalls with remote management, mail and web servers, and then try stolen passwords or known vulnerabilities on whatever answers. The other common route skips the public address entirely: a phishing e-mail makes an employee run something, and the infected computer then calls out to the attacker. Check from outside which ports you expose, close everything that is not needed, put the rest behind a VPN with multi-factor authentication (MFA), and patch internet-facing devices first. On monitored segments, NetSenX shows which hosts are reached from outside and flags the beaconing that follows an infection.

← All 35 questions on Have I been hacked?All topics