# Remote work and exposed services (FAQ)

> 40 questions on Remote work and exposed services, in plain language: what to check, what NetSenX shows and what a sensor cannot see.

Source page: https://netsenx.com/en/faq/remote

## Is remote desktop (RDP) exposed to the internet dangerous?

Yes. Remote desktop (RDP) open to the internet is scanned constantly and attacked with stolen and guessed passwords, and an exposed remote-access service is a common way into small companies. Close it, or put it behind a VPN or a remote-desktop gateway with multi-factor authentication, and allow only named accounts to use it. Check what you actually expose with an external port scan of your own public IP addresses, and repeat it after every firewall or router change, because forwarded ports tend to outlive the project they were opened for. Inside the network, NetSenX flags unusual RDP sessions between hosts as lateral movement, and repeated login attempts against monitored hosts, on every plan. It does not scan your public addresses, so the external check stays your job.

https://netsenx.com/en/faq/is-rdp-exposed-to-the-internet-dangerous

## How do we know if our VPN has been compromised?

Check the VPN's own logs first: sign-ins at odd hours or from unexpected countries, accounts that never used the VPN before, many failed attempts, and new configuration changes or admin accounts on the appliance. Compare its software version with the vendor's security advisories, because VPN gateways are a frequent target of exploited flaws, and run the vendor's published compromise checks if there are any. Behind the VPN, an attacker's next steps show on the network: scanning from the VPN address pool, new sessions from VPN addresses to servers they never used, large transfers out. NetSenX flags those where the segment behind the VPN is monitored, on every plan, and its VPN view lists the tunnels and gateway sessions it sees, with the country each remote address is registered in. It does not read the appliance's logs and cannot inspect the appliance itself.

https://netsenx.com/en/faq/how-do-i-know-if-our-vpn-is-compromised

## Can an infected home laptop spread malware into the office over the VPN?

Yes. Once connected, a laptop on the VPN is inside the network, often with wide access. Malware picked up at home, from a family member's download or a compromised home router, can then scan the office network and reach file shares and servers like any other internal host. Limit what VPN users can reach to the systems they need, require multi-factor authentication, keep endpoint protection and updates current on remote laptops, and do not let personal devices connect to the company VPN. If the VPN traffic crosses a monitored segment, NetSenX sees the laptop's connections and flags scanning, lateral movement and beaconing from it, on every plan. A laptop that runs the agent is watched on its own, wherever it is. What happens inside the laptop stays the job of endpoint protection.

https://netsenx.com/en/faq/can-an-infected-home-laptop-spread-malware-over-the-vpn

## Is it safe to expose SSH to the internet?

It is common, but it is a standing target: internet-facing SSH servers receive automated login attempts constantly. If you must expose it, allow key-based logins only, disable password and root logins, keep OpenSSH patched and restrict the source addresses where you can; a VPN or a bastion host in front of it is better still. A different port reduces log noise but is not protection. Keep a list of every SSH server you expose and review it, because forgotten test servers are the ones that stay unpatched. NetSenX sees connections to monitored hosts and flags scanning, repeated login attempts and unusual sessions involving them, on every plan. From the Pro plan, with packet capture on a Linux agent or a SPAN or TAP sensor, its cryptographic inventory also lists the SSH versions that servers announce.

https://netsenx.com/en/faq/is-it-safe-to-expose-ssh-to-the-internet

## Which services should never be exposed to the internet?

Remote desktop (RDP), file sharing (SMB), database ports, the management interfaces of firewalls, switches, printers and hypervisors, and industrial protocols such as Modbus or S7 should not be reachable from the internet. Put what staff need from outside behind a VPN or a gateway with multi-factor authentication, and keep the rest internal. Check regularly with an external scan of your own address ranges, after every firewall or router change, and switch off automatic port opening (UPnP) on routers. Cloud servers count too: their security groups open ports as easily as an office firewall does. NetSenX sees inbound connections to monitored hosts, on every plan, so a service that unexpectedly answers outside connections, or a host being scanned or hit by repeated logins, shows up in its traffic. It does not scan your public addresses.

https://netsenx.com/en/faq/which-services-should-never-be-exposed-to-the-internet

## How does remote working increase cyber-security risk?

It moves company devices and data onto networks you do not control, and it widens the ways in. Laptops sit on home Wi-Fi next to family devices and an old router, connect from hotels and trains, and travel to places where they can be lost. Staff sign in from outside, so a stolen password becomes usable from anywhere, and remote-access services such as VPN gateways and remote desktop must be reachable from the internet. Support also gets harder, because updates and fixes depend on the laptop connecting. The answer is mostly identity and endpoint work: multi-factor authentication everywhere, full-disk encryption, endpoint protection and automatic updates on every laptop, and a VPN or gateway that reaches only what each person needs. The network part is where remote devices reach the company: NetSenX sees VPN traffic on a monitored segment behind the gateway and flags scanning, lateral movement and beaconing from it, on every plan, and an agent on a Linux or macOS laptop watches that laptop wherever it is.

https://netsenx.com/en/faq/how-does-remote-work-increase-cyber-risk

## How do I secure remote workers who access the company network?

Start with the account and the device, then limit what the connection can reach. Require multi-factor authentication for the VPN, e-mail and every cloud application; give staff company laptops with full-disk encryption, endpoint protection and automatic updates; and keep personal devices off the VPN. Configure the VPN or remote-access gateway so that each group reaches only the systems it needs, not the whole office network, and log every session. Give staff a simple way to report a lost laptop or an odd sign-in prompt, and remove access on the day someone leaves. Then watch the point where remote work meets the company: with a sensor on a SPAN or TAP port behind the VPN gateway, NetSenX sees what remote devices do inside the network and flags scanning, lateral movement, beaconing and unusual outbound volume on every plan. It does not manage accounts, devices or the VPN; your identity provider, device management and gateway do.

https://netsenx.com/en/faq/how-to-secure-remote-workers-accessing-the-company-network

## Do we need a VPN for remote work?

Only if staff need to reach systems inside your office network. If everything people use is a cloud service, such as e-mail, files and accounting, a VPN adds little: protect those services with multi-factor authentication and managed laptops instead. If there is a file server, an accounting database or a machine in the office that people need from home, then yes: use a VPN or a remote-access gateway rather than opening those services to the internet, and require multi-factor authentication for it. A consumer VPN app that hides your browsing is a different product and does not protect company systems. Whichever you choose, give each person access only to what they need. NetSenX does not provide a VPN. Behind your VPN gateway, a sensor on a SPAN or TAP port sees what remote devices do on the internal network and flags scanning, lateral movement and beaconing, on every plan.

https://netsenx.com/en/faq/do-we-need-a-vpn-for-remote-work

## Is a VPN protected only by a password enough?

No. A VPN with password-only sign-in lets anyone with a stolen, guessed or reused password into your network, and VPN credentials are exactly what phishing pages and password-guessing tools go after. Add multi-factor authentication (MFA) to the VPN before anything else, prefer an authenticator app or a hardware key over text messages, and disable accounts that have not used the VPN for months. Restrict who may connect at all, by group, and log sign-ins so that you can see attempts from unusual places. Keep the VPN appliance itself patched, because a flaw in the gateway can bypass the password entirely. NetSenX does not check VPN sign-ins; that is the job of the VPN and your identity provider. Where the segment behind the VPN is monitored, it flags what an intruder does next, such as scanning, lateral movement or beaconing, on every plan.

https://netsenx.com/en/faq/is-a-vpn-without-multi-factor-authentication-enough

## Why are unpatched VPN gateways such a risk?

Because the VPN gateway is reachable from the whole internet by design and trusted by your internal network, a security flaw in it can let an attacker in without any password. Flaws in VPN and remote-access appliances from several major vendors have been exploited widely in recent years, and national cyber-security agencies regularly publish urgent advisories about them. Treat the gateway as your most exposed system: subscribe to the vendor's security advisories, patch within days rather than at the next maintenance window, run the vendor's published compromise checks after a critical flaw, and restrict the management interface to internal addresses. If you cannot patch quickly, consider a managed service. A network sensor cannot see a flaw being exploited inside the appliance, but it can see what comes next: monitoring the segment behind the gateway, NetSenX flags scanning, lateral movement and beaconing from VPN addresses, on every plan.

https://netsenx.com/en/faq/why-are-unpatched-vpn-gateways-a-risk

## What is split tunnelling on a VPN, and is it a risk?

Split tunnelling means that only traffic for company systems goes through the VPN, while everything else, such as web browsing and video calls, goes straight to the internet from wherever the laptop is. It saves bandwidth and makes calls smoother, which is why it is common. The risk is smaller than it sounds if the laptop itself is protected: the device becomes the boundary, so it needs endpoint protection, updates and any web filtering you use. The trade-off is visibility: internet traffic that never enters the VPN never crosses your office network, so office firewalls and network sensors do not see it. Decide deliberately: full tunnelling if you need to inspect all traffic centrally, split tunnelling with strong endpoint controls otherwise. NetSenX sees the part that crosses a monitored segment; for the rest, an agent on a Linux or macOS laptop watches that laptop's own connections wherever it is.

https://netsenx.com/en/faq/what-is-split-tunnelling-and-is-it-a-risk

## Where should a sensor sit to see what VPN users do?

Behind the VPN gateway, on the internal side, where the tunnel has ended and remote users' traffic is ordinary internal traffic again. A sensor in front of the gateway, on the internet side, sees only encrypted tunnels and learns little from them. In practice, mirror the switch port that connects the VPN gateway or firewall to the internal network, or the link between it and the server segment, to a SPAN or TAP port. Give VPN users addresses from their own pool, so that their traffic is easy to recognise. With NetSenX, one agent on that SPAN or TAP port counts as one device and watches every VPN session that passes it: scanning, lateral movement, beaconing and unusual outbound volume are flagged on every plan, and the VPN view lists the tunnels and gateway sessions it sees. Traffic that a split-tunnelled laptop sends straight to the internet never reaches that sensor.

https://netsenx.com/en/faq/where-should-a-sensor-sit-to-see-vpn-users-traffic

## How do I detect a VPN account used from two countries at the same time?

With your VPN gateway's or identity provider's sign-in logs, because only they know which account each session belongs to. Look for the same user signing in from two places too far apart for the time between them, a session from a country where you have no staff, or a sign-in from an address that belongs to a hosting provider or an anonymising service. Many identity providers and VPN gateways can raise this automatically, often as impossible-travel or risky sign-in detection; switch it on, and require multi-factor authentication so that a stolen password alone is not enough. The network gives the second half of the picture. The NetSenX VPN view lists the tunnels and gateway sessions it sees on monitored segments, with the country the remote address is registered in, and flags addresses on lists of commercial VPN services and Tor exits. It does not link sessions to accounts, so the identity logs remain the place where this alert belongs.

https://netsenx.com/en/faq/how-to-detect-a-vpn-account-used-from-two-countries

## What is impossible travel, and which tool detects it?

Impossible travel is a sign-in pattern in which the same account signs in from two places that nobody could travel between in the time that passed, such as Madrid at 09:10 and another continent at 09:40. It usually means a stolen password or session token in use, although a VPN service, a mobile network or a cloud proxy can produce false matches. It is detected by the systems that see sign-ins together with the account name: your identity provider, the cloud office suite or the VPN gateway. Most offer it as a built-in risk signal; check that it is switched on and that someone receives the alert. Location comes from address registration data, so treat it as an indicator, not proof. A network sensor such as NetSenX does not see account sign-ins and does not raise impossible-travel alerts. It helps afterwards, by showing what the session did inside the network: scanning, lateral movement or large transfers out.

https://netsenx.com/en/faq/what-is-impossible-travel-and-which-tool-detects-it

## Can network monitoring see where our VPN users connect from?

Partly. A sensor that sees the VPN gateway's traffic knows the public address each tunnel comes from, and that address can be matched to the country of the network it is registered to. That is useful but not precise: registration data shows where the network's owner is registered, not where the person sits, and travel, mobile networks, hotel Wi-Fi and commercial VPN services all blur it. The sensor also does not know which account a tunnel belongs to; the VPN gateway's own logs do. The NetSenX VPN view lists the VPN tunnels and gateway sessions it sees on monitored segments, with the country taken from network registration data, and flags addresses on lists of commercial VPN services and Tor exits. Use it beside the gateway's sign-in logs: the logs say who, the network view says from which network and what happened next.

https://netsenx.com/en/faq/can-network-monitoring-see-where-vpn-users-connect-from

## Can NetSenX monitor a laptop that is outside the office?

Yes, if the laptop runs the NetSenX agent; otherwise only when its traffic comes back through a monitored segment. The agent runs on Linux and macOS and watches that laptop's own connections wherever it is, at home, in a hotel or on a train, and alerts such as beaconing, scanning or unusual outbound volume reach your dashboard, on every plan. Each laptop with the agent counts as one device. On macOS the agent runs in a basic mode that does not capture packets, so features that need packet capture, such as TLS fingerprinting, are not available there. A laptop without the agent is seen only when it connects through the office network, or over a VPN whose traffic crosses a monitored segment. What the agent never sees is the content of encrypted traffic or what happens inside the laptop; endpoint protection covers that part.

https://netsenx.com/en/faq/can-netsenx-monitor-a-laptop-outside-the-office

## Do home-office laptops need the NetSenX agent installed?

Not necessarily. If remote staff reach company systems only through a VPN, a sensor on a SPAN or TAP port behind the VPN gateway already sees what their laptops do on the internal network, which is where most damage is done, and that sensor counts as one device. Install the agent on a laptop when you want to watch its connections even while it is off the VPN: for example a manager's or administrator's laptop, a developer's machine with access to production, or a laptop that uses split tunnelling. Each laptop with the agent counts as one device, so decide by risk rather than by headcount. The agent runs on Linux and macOS; on macOS it works in a basic mode without packet capture. For every laptop, agent or not, keep endpoint protection, updates and disk encryption, because no network sensor sees what happens inside the device.

https://netsenx.com/en/faq/do-home-office-laptops-need-the-netsenx-agent

## Should executive laptops get extra monitoring?

Usually yes, because they hold the most valuable mailbox and files and travel the most. The first measures are on the device and the account: phishing-resistant multi-factor authentication, full-disk encryption, endpoint protection with someone reading its alerts, automatic updates, and a clear rule for what to do if the laptop is lost. Executives are also the usual target of payment-fraud e-mails, which no network tool stops; a call-back rule for changed bank details does. Network monitoring adds a view of what the laptop does: with the NetSenX agent installed, on Linux or macOS, the laptop's own connections are watched wherever it is, and beaconing, scanning or unusual outbound volume raises an alert, on every plan. That watches the device, not the person, and never reads the content of encrypted traffic. Agree the scope with the executives first, so that the monitoring is a protection they asked for.

https://netsenx.com/en/faq/should-executive-laptops-get-extra-monitoring

## What does a network sensor see when a laptop comes back to the office after a trip?

Everything the laptop does once it is on a monitored segment, which is exactly when a compromise picked up on the road becomes visible. Malware installed in a hotel or through a fake update usually calls home at regular intervals, looks for other hosts or reaches for file shares and admin services. A sensor on a SPAN or TAP port sees those connections from the first minute, and NetSenX flags beaconing, scanning, lateral movement and unusual outbound volume on every plan. What it does not see is what happened during the trip: traffic on the hotel network never crossed yours, unless the laptop runs the NetSenX agent, which watches its connections wherever it is. A sensible routine after travel to high-risk destinations: let endpoint protection run a full scan, apply pending updates, and change passwords if the device was out of your sight, for example at a border check.

https://netsenx.com/en/faq/what-does-a-sensor-see-when-a-laptop-returns-from-a-trip

## Is an employee's home router a risk to the company?

It can be, mostly indirectly. Home routers are often years old, never updated and still on the default admin password, and some models have known flaws that attackers exploit at scale to build networks of hijacked routers. A compromised router can redirect traffic, watch unencrypted connections and attack other devices on the home network, including a work laptop. The company cannot manage the router, so protect the laptop instead: endpoint protection, updates, the laptop's own firewall, the VPN or encrypted connections for all company traffic, and no personal devices on the VPN. Give staff a short checklist for home: update the router, change its admin password, switch off remote administration and automatic port opening (UPnP), and put smart-home devices on a separate Wi-Fi if the router offers one. NetSenX does not see home networks; it sees what the laptop does when it reaches a monitored company segment, or wherever it is if it runs the agent.

https://netsenx.com/en/faq/is-a-home-office-router-a-risk-to-the-company

## Is public Wi-Fi safe for a work laptop?

It is acceptable with a protected laptop and encrypted connections, and risky without them. Most websites and company services already use encryption, so a stranger on the same café or hotel network cannot read the content, but they can see which devices are present, try to attack open services on your laptop or set up a fake network with the same name. Use the company VPN or your phone's hotspot for anything sensitive, keep the laptop's firewall on and file sharing off, treat a certificate warning as a reason to disconnect, and forget the network afterwards so that the laptop does not join it automatically next time. Updates and endpoint protection matter more on the road than in the office. NetSenX does not see the café network. A laptop that runs the agent, on Linux or macOS, has its own connections watched wherever it is, and beaconing or unusual outbound volume raises an alert on every plan.

https://netsenx.com/en/faq/is-public-wifi-safe-for-a-work-laptop

## Should a work laptop be used for personal browsing at home?

Preferably not, and a short written rule helps more than a ban nobody enforces. Personal use brings risks onto the device that holds company data: games and browser extensions from unknown sources, pirated software, children using the laptop, and personal accounts with reused passwords. If you allow limited personal use, set clear limits: no software installed without IT, no family members, a separate browser profile for personal accounts, and no company files in personal cloud storage. Make sure staff are not local administrators, so that most unwanted software cannot install itself. This is a policy and endpoint question, and a network sensor cannot enforce it. NetSenX watches devices, not people: it would flag the consequences, such as beaconing from malware or unusual uploads, when the laptop's traffic crosses a monitored segment or the laptop runs the agent, but it does not report on anyone's browsing habits.

https://netsenx.com/en/faq/should-a-work-laptop-be-used-for-personal-browsing

## Can staff use their personal devices for work?

For limited, low-risk tasks, if you set rules; but personal devices should not join the company VPN or hold company files outside managed apps. The company cannot see whether a personal phone or laptop is updated, encrypted or infected, and cannot wipe it when the person leaves. A common middle ground: allow e-mail and chat on personal phones through managed apps with a PIN and remote wipe of the company data only, allow browser access to the cloud office with multi-factor authentication, and keep everything that needs access to internal systems on company devices. Write the rules down, including what happens to company data when someone leaves, and agree them with your works council where there is one. On the network, a personal device that connects to a monitored segment appears on the NetSenX network map, and scanning, beaconing or unusual outbound volume from it is flagged on every plan.

https://netsenx.com/en/faq/can-staff-use-personal-devices-for-work

## What should we do when a work laptop is lost or stolen?

Act on the accounts first, then the device. On the same day: end the user's active sessions and change the password, check that multi-factor authentication is still bound to the user's own phone, revoke the laptop's VPN certificate or access, and, if you use device management, lock or wipe it remotely. If the disk was encrypted and the laptop was locked, the data is very likely safe; if not, assume it can be read and check whether personal data is involved, because a personal-data breach may have to be reported under the GDPR, so involve your data protection officer the same day. Report a theft to the police and keep the reference for your insurer. Then check whether the device has connected since: the NetSenX network map shows when a device was last seen on a monitored segment, and for a laptop with the agent the dashboard shows when it last reported. A network tool cannot locate or wipe the laptop.

https://netsenx.com/en/faq/what-to-do-when-a-work-laptop-is-lost-or-stolen

## Can my employer see my traffic when I use the company VPN?

Partly, and it depends on the company's tools more than on the VPN. Traffic that goes through the VPN passes the company's network, so its firewall and monitoring can see which servers your laptop connects to and how much data flows. Most of that traffic is encrypted, so the content of web pages, messages and files is not visible to a network sensor unless the company runs a system that decrypts it, which your workplace policy should disclose. Software installed on a company laptop can see much more, which is why the laptop policy matters more than the VPN. Where NetSenX is used, it watches devices and connections, not people: it records connection metadata such as destinations, timing and volume to detect attacks, never decrypts traffic and never reads what you type. Ask your employer for its monitoring policy; in the EU, data protection law expects employers to tell staff how they are monitored.

https://netsenx.com/en/faq/can-my-employer-see-my-traffic-on-the-company-vpn

## Is it safe to use a personal VPN app on a work computer?

Usually not, and most company policies forbid it. A personal VPN app sends all of the laptop's traffic through a third party's servers, which can break the company VPN, bypass the company's web filtering and monitoring, and hand your company's traffic metadata to a provider nobody vetted. Free VPN apps in particular earn their money somehow, often from data. It also makes your traffic appear to come from another country, which can trigger account lockouts and risky sign-in alerts. If you need privacy on public Wi-Fi, use the company VPN or your phone's hotspot. If you are an administrator, block the installation of unapproved software and look for laptops whose traffic suddenly all goes to one outside address. On a monitored segment, the NetSenX VPN view flags addresses on lists of commercial VPN services, so a laptop tunnelling everything to one of them stands out.

https://netsenx.com/en/faq/is-it-safe-to-use-a-personal-vpn-on-a-work-computer

## Is a remote-desktop app that staff installed on an office PC a risk?

Yes. Remote-desktop apps that work through the vendor's cloud need no open port, so they slip past the firewall and create a permanent door into the office network protected only by that app's account. Support scammers use the same apps, and attackers who steal the account, or who are already inside, can use an installed tool to come back at any time without malware. The person who installed it usually meant well, so offer a sanctioned alternative: the company VPN, a remote-desktop gateway or one approved remote-support tool with multi-factor authentication, managed by IT. Then block the installation of unapproved software and remove the others. On the network, these apps keep a regular connection to their relay servers, which NetSenX flags as beaconing on every plan; when the agent runs on that computer, the alert names the local program. NetSenX does not uninstall or block the app.

https://netsenx.com/en/faq/is-a-remote-desktop-app-on-an-office-pc-a-risk

## How do we find remote-desktop apps installed without permission?

Use three sources: the software inventory, the network traffic and DNS. Your endpoint management or antivirus console can usually list installed programs; search it for remote-desktop and remote-support tools. On the network, these apps keep a steady connection to their vendor's relay servers even when nobody is using them, so a PC that contacts the same outside service every few minutes, day and night, is worth checking. Your DNS or firewall logs show the vendor domains they look up. Once found, decide case by case: remove the tool, or replace it with the approved one. Prevent repeats by removing local administrator rights and allow-listing software. NetSenX flags the regular check-ins as beaconing, on every plan, from a SPAN or TAP sensor or from the agent on that host, and when the agent runs on the computer, the alert names the program. It does not keep a software inventory; your endpoint tools do.

https://netsenx.com/en/faq/how-to-find-remote-desktop-apps-installed-without-permission

## What is a bastion host or remote-desktop gateway, and do we need one?

It is a single hardened server that administrators and suppliers must pass through to reach internal systems, instead of connecting to each server directly. Remote sessions end on the bastion, which enforces multi-factor authentication, allows only named accounts, logs or records each session, and is the only host the servers accept administrative connections from. A remote-desktop gateway does the same for remote desktop, wrapping it in an encrypted, authenticated connection. You need one as soon as more than a couple of people, or any supplier, administer your servers remotely, or when SSH or remote desktop would otherwise face the internet. Keep the bastion patched and minimal, with no other software on it. Monitoring then has a simple rule to check: administrative sessions should come from the bastion only. NetSenX flags unusual sessions between hosts as lateral movement, on every plan, so admin traffic that bypasses the bastion stands out.

https://netsenx.com/en/faq/what-is-a-bastion-host-or-remote-desktop-gateway

## Is leaving SSH open to the internet bad practice even with Fail2ban?

Fail2ban helps, but it does not make an exposed SSH server safe. It blocks addresses after a number of failed logins, which cuts password guessing and log noise, but attackers spread their attempts across many addresses, and it does nothing against a flaw in the SSH server itself or a stolen private key. The real protection is in the configuration: key-based logins only, password and root logins disabled, OpenSSH kept up to date, and access limited to known source addresses or placed behind a VPN or bastion host. With those in place, Fail2ban is a reasonable extra layer. Review regularly which servers expose SSH at all; the forgotten ones are the risk. NetSenX sees connections to monitored SSH servers and flags repeated login attempts, scanning and unusual sessions, on every plan. It does not block addresses itself; Fail2ban or the firewall does that.

https://netsenx.com/en/faq/is-leaving-ssh-open-bad-practice-even-with-fail2ban

## Does moving SSH to a non-standard port help?

A little against noise, and not at all against a targeted attacker. Automated scanners that only try port 22 will miss it, so logs get quieter and fewer guessing attempts arrive. But a full port scan finds an SSH server on any port, because SSH announces itself in its first message, and anyone looking for your server in particular will run that scan. So treat a port change as housekeeping, not protection, and keep the measures that matter: key-based logins only, no password or root logins, an up-to-date OpenSSH, and access limited by source address or through a VPN or bastion host. Document the port so that colleagues and your own monitoring do not mistake it for something unknown. NetSenX sees connections to monitored hosts on any port and flags scanning, repeated login attempts and unusual sessions, on every plan.

https://netsenx.com/en/faq/does-moving-ssh-to-a-non-standard-port-help

## How do I know if someone is brute-forcing our SSH servers right now?

Look at the server's authentication log: many failed logins for root, admin or random user names, from one address or many, are the classic sign, and tools such as Fail2ban count them for you. On an internet-facing server some of this is constant background noise; what matters is whether any attempt succeeded, so look for successful logins from unfamiliar addresses, at odd hours or for accounts that rarely log in, and check that password logins are disabled. Attempts from inside your own network are more serious, because they mean a compromised host is doing the guessing. NetSenX flags repeated login attempts against monitored hosts as brute force, on every plan, together with scanning and unusual sessions, so attempts from an internal host stand out. It cannot tell from the network whether a password was accepted; the server's log can.

https://netsenx.com/en/faq/how-to-know-if-someone-is-brute-forcing-our-ssh-servers

## Are we affected by OpenSSH flaws such as regreSSHion?

Only if a server runs an affected OpenSSH version in an affected configuration, so start by finding every SSH server you have. regreSSHion (CVE-2024-6387), published in July 2024, affects the OpenSSH server on glibc-based Linux from version 8.5p1 up to, but not including, 9.8p1, as well as very old releases before 4.4p1; other flaws have other ranges, so read each advisory. List your servers from your inventory and from the network, including appliances, containers and forgotten test machines. Check the installed package against your distribution's security tracker, because distributions often backport fixes without changing the version number, then patch, or restrict access until you can. From the Pro plan, the NQCI cryptographic inventory, in preview, lists every SSH server whose version banner it has seen, with the version announced; it needs packet capture, switched on for a Linux agent or a SPAN/TAP sensor. A banner is a hint, not a verdict, so confirm on the server.

https://netsenx.com/en/faq/are-we-affected-by-openssh-flaws-like-regresshion

## Can malware travel back to my computer over an SSH session?

Not by itself: an ordinary SSH session carries your keystrokes and the server's screen output, and a compromised server cannot push a program onto your computer through it. The risks come from the features you add. Agent forwarding lets the server use your SSH keys while you are connected, so a compromised server can reach other servers as you; use it only towards trusted hosts, or use a jump-host setting instead. Port forwarding and X11 forwarding open channels back to your machine. Files you copy from the server can carry malware like any download. And a vulnerable SSH client can in principle be attacked by a malicious server, so keep the client updated. On the network, a session from an admin laptop to a server is normal; NetSenX flags unusual sessions between hosts as lateral movement, on every plan, so an SSH session that starts hopping onwards from a server stands out.

https://netsenx.com/en/faq/can-malware-travel-back-over-an-ssh-session

## How can SSH tunnels bypass a firewall?

SSH can carry other traffic inside its encrypted connection, so anyone allowed to make one outbound SSH connection can tunnel almost anything through it. A port forward makes an internal service reachable from outside, or an outside service reachable from inside, without any firewall rule changing; a dynamic forward turns the SSH connection into a proxy for all of a user's traffic. Attackers use this to keep remote access and to move data out quietly. Reduce the risk: allow outbound SSH only from the hosts that need it and only to known destinations, disable forwarding on your SSH servers where it is not needed, and treat a long-lived SSH session from a workstation to an unknown internet address as suspicious. A network sensor cannot see inside the tunnel, but it sees the tunnel: NetSenX flags long-lived or regular connections to outside hosts as beaconing and large transfers as unusual outbound volume, on every plan.

https://netsenx.com/en/faq/how-can-ssh-tunnels-bypass-a-firewall

## Is it safe to use SSH over public Wi-Fi?

Yes, SSH is designed for untrusted networks: the connection is encrypted and the server proves its identity with its host key. The weak point is accepting a wrong host key. The first time you connect, and every time SSH warns that a host key has changed, check the fingerprint against one you obtained through another channel before you continue; on a café network, a changed key is a reason to stop. Use key-based logins rather than passwords, protect your private key with a passphrase, and keep the SSH client updated. Better still, connect through the company VPN or your phone's hotspot, so that the café network sees only one encrypted tunnel. NetSenX does not see public Wi-Fi networks. It sees the SSH session when it reaches a monitored server, and flags repeated login attempts and unusual sessions involving that server, on every plan.

https://netsenx.com/en/faq/is-ssh-over-public-wifi-safe

## How dangerous is port forwarding to a server in the office?

It puts that server directly on the internet, where automated scans find it quickly and attacks never stop, so it is as dangerous as the service and its maintenance are weak. A forwarded port to a web server that is patched weekly is a manageable risk; a forwarded port to a storage box, a camera recorder, remote desktop or an old test machine is a common way into small offices. Prefer alternatives: a VPN for staff, a cloud-hosted service, or a reverse proxy in a separate network segment. If you must forward, forward one port to one hardened host, keep it updated, require strong authentication, log access, and isolate the host from the rest of the network so that a compromise stays there. Check the router for forgotten forwards and automatic port opening (UPnP), and switch them off. NetSenX sees inbound connections to monitored hosts and flags scanning, repeated login attempts and lateral movement from the exposed host, on every plan.

https://netsenx.com/en/faq/how-dangerous-is-port-forwarding-for-an-office-server

## How do I check what our company exposes to the internet?

Look at yourself from the outside, regularly. List your public IP addresses and domain names, including cloud servers and the office internet connection, then scan them from outside your network with a port scanner you trust, and ask your national CERT whether it offers a notification service for exposed systems. Compare the open ports with what you intended: anything you cannot explain, such as remote desktop, a database, a storage box or a router's admin page, should be closed or moved behind a VPN. Repeat after every firewall, router or cloud change, and check public certificate logs for subdomains you forgot. Scan only addresses you own or are authorised to test. NetSenX does not scan your public addresses. Inside the network it sees inbound connections to monitored hosts, on every plan, so a service that unexpectedly answers outside connections, or a host being scanned or hit by repeated logins, shows up in its traffic.

https://netsenx.com/en/faq/how-to-check-what-our-company-exposes-to-the-internet

## Is automatic port opening (UPnP) on the office router a risk?

Yes, and on an office network usually a needless one. Universal Plug and Play (UPnP) lets any device inside the network ask the router to open a port to the internet, with no password and without telling anyone. Game consoles and video apps like it; so do compromised devices and malware, which can use it to make themselves reachable from outside. Cameras and recorders often open ports this way during installation. Switch UPnP off on the office router, and on the home routers where staff work, then check which ports are already forwarded and remove those you cannot explain. Some routers also expose UPnP to the internet side by mistake, which is worse; an external scan shows it. A network sensor does not see the router's configuration, but it sees the effect: NetSenX sees inbound connections from the internet to monitored hosts, so a device that suddenly receives connections from outside stands out.

https://netsenx.com/en/faq/is-upnp-on-the-office-router-a-risk

## Who notices a remote login at 3 a.m. on a Sunday?

Often nobody until Monday, which is why attackers like weekends and holidays. The fix is less about more people and more about deciding in advance what wakes someone up. Most small companies cannot staff a night shift, so pick a few events that justify a phone call, such as a successful admin login from an unusual place, a remote session to a server at night or a large transfer out, and route only those to a phone. Everything else can wait for the morning review. Make sure your VPN and identity provider send sign-in alerts somewhere that is read, and agree who is on call during holidays. NetSenX detects around the clock, but people do not: it flags lateral movement, beaconing, scanning and unusual outbound volume on every plan and, from the Pro plan, can send alerts to Slack or a webhook so that they reach a phone. It does not provide a staffed security operations centre.

https://netsenx.com/en/faq/who-notices-a-remote-login-at-3-am-on-a-sunday

FAQ: https://netsenx.com/en/faq