Free tools Windows power users keep installed
One-click scans. No signup required.
Harden internet-facing devices in this order: inventory everything reachable from outside, remove exposure that has no operational purpose, and then protect the systems that must remain public. Change default credentials, patch supported software and firmware promptly, replace devices that no longer receive security updates, keep administration on trusted networks behind a monitored jump host, require multifactor authentication where the identity system supports it, segment public services from internal systems, disable weak protocols, and continuously scan and monitor for changes. This approach follows CISA guidance and reduces the paths an attacker can use to reach a device or pivot into your network.
What remote exploitation means for an internet-facing device
A device is internet-facing when a system, service, management interface, or listening port can be reached from outside the organization’s trusted networks. That reachability may be intentional, such as a public website, mail server, VPN gateway, or DNS service. It may also be accidental: a forgotten test server, a remote-administration page left on a public address, or a device that became reachable after a firewall or routing change.
As an Amazon Associate I earn from qualifying purchases.
Remote exploitation occurs when an attacker uses that reachability together with a vulnerability, weak credential, unsafe configuration, or unnecessary service to make the device perform an unauthorized action. The result can be account takeover, data theft, ransomware deployment, service disruption, or a foothold for attacks on internal systems. CISA’s Internet Exposure Reduction Guidance, published June 4, 2025, warns that “Many organizations unknowingly leave common vulnerabilities and weaknesses exposed to the internet, making them easy targets for exploitation.”
Recommended Free Tools
Exposure reduction is therefore the first control, not an afterthought. A patched device that does not need to be public is still carrying avoidable risk; a necessary public service still needs secure authentication, current updates, restricted administration, segmentation, and monitoring.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Step 1: Build a reliable inventory of external exposure
You cannot harden what you cannot identify. Start with an authorized inventory that records every public IP address, hostname, cloud endpoint, firewall rule, port-forwarding rule, remote-access service, and management interface. Include systems operated by contractors or business units, not just assets owned by the central IT team.
Collect internal and external views
Compare configuration data from firewalls, routers, cloud consoles, DNS, certificate records, vulnerability scanners, and asset-management systems. Then validate it from outside the network with an authorized scan. CISA identifies its Cyber Hygiene Vulnerability Scanning service and public visibility resources such as Thingful, Censys, Shodan, and Shadowserver as possible inputs for discovering internet-accessible assets. Use only scans and searches that your organization is authorized to perform.
An external scan is evidence of what appears reachable at a particular time; it is not a security certificate. It can miss assets, misidentify ownership, or fail to reveal a service that is temporarily offline. Treat every finding as a lead that must be assigned to an owner, verified, and remediated or formally accepted.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRecord the facts needed for a decision
| Inventory field | Why it matters |
|---|---|
| Public address, hostname, and cloud account | Identifies the exact exposure and the team that can change it. |
| Listening ports and services | Shows what an attacker can attempt to reach. |
| Business purpose and owner | Separates essential services from forgotten or unauthorized exposure. |
| Software, firmware, and support status | Determines whether security fixes are available. |
| Authentication and administrative path | Reveals default credentials, public login pages, and whether management can be moved to a trusted network. |
| Dependencies and outage impact | Prevents a firewall or routing change from breaking an essential process. |
| Last review and next review date | Provides evidence that exposure is being reassessed as the environment changes. |
Resolve unknown ownership before changing access
For each finding, identify a responsible owner and verify the service’s dependencies. A port that looks unnecessary may support a production application, a supplier connection, or an emergency process. Conversely, an owner may discover that an exposed service has no current user. Record the decision, the person accountable for it, and the change window before removing access.
Step 2: Decide what truly needs to remain public
Evaluate each exposed service individually rather than treating a whole device as “required.” Ask:
- What business or safety function requires this service to be reachable from the public internet?
- Who needs access, from which networks, and at what times?
- Can users reach it through a VPN, private connection, or allowlisted trusted network instead?
- Can a public-facing component handle the request without exposing the underlying system or management plane?
- Is the software supported and capable of receiving timely security updates?
- What is the consequence of removing or restricting the service, and which dependencies must be tested first?
| Exposure decision | Use it when | Required follow-through |
|---|---|---|
| Remove from the internet | There is no current operational need for public reachability. | Delete the public DNS record, close the firewall or security-group rule, remove port forwarding, and verify externally that the service is no longer reachable. |
| Restrict to trusted networks | Known users or systems need access, but the whole internet does not. | Use network allowlists, private routing, or a VPN; review the allowlist and authentication path regularly. |
| Keep public with compensating controls | The function is genuinely public and cannot be moved behind a private path. | Apply current patches, remove default credentials, enforce strong authentication, restrict administration, segment the service, and monitor traffic and logs. |
| Replace the asset | The device or software is unsupported and cannot receive security fixes. | Plan migration, test dependencies, remove the old exposure, and confirm the replacement is supported before publishing it. |
Do not describe an internet-facing service as necessary merely because it has always been reachable. CISA recommends assessing which assets need to remain accessible and restricting or removing access that is not necessary, while reviewing interdependencies before making changes.
Step 3: Harden systems that must remain exposed
Remove default and weak credentials
Change every vendor-supplied username and password before a device is connected to the internet. Use unique administrative credentials, store them in an approved password manager or secrets system, and remove or disable accounts that are not needed. Check service accounts, API keys, emergency accounts, and local administrator accounts as well as the main login.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Credential changes do not replace patching or network restrictions. A strong password on a vulnerable public service still leaves an attacker another route to exploitation.
Patch supported software and firmware promptly
Prioritize internet-facing systems, especially vulnerabilities known to be exploited. Maintain an inventory of versions and support dates so that a patch delay is visible and accountable. Test updates against the application’s dependencies, but do not allow an indefinite “testing” status to leave a critical public vulnerability exposed. Use a temporary access restriction or compensating control when an update must be scheduled.
Replace unsupported devices and software
A product that no longer receives security updates cannot be made equivalent to a supported system by adding a stronger password. Replace it, isolate it behind a control that removes public reachability, or retire the service. Document the risk and a deadline if a short transition period is unavoidable.
Restrict service access with ACLs and equivalent controls
Allow only the source networks, destination ports, and protocols required for the service. Apply restrictions at firewalls, cloud security groups, reverse proxies, host firewalls, and the application itself where appropriate. Deny management traffic from the public internet even when the public application traffic remains open.
Use a monitored jump host for administration
Administrators should connect from trusted devices to a controlled jump host, then reach the managed device through a private management path. Log authentication, commands where supported, session duration, and destination systems. Alert on unusual sources, times, or administrative actions. A jump host is a control point, not a reason to expose the device’s own management interface.
Enable multifactor authentication where possible
Require more than a password for administrative access and remote services when the relevant identity provider, VPN, or device supports it. Multifactor authentication reduces the impact of stolen passwords but does not prevent exploitation of an unpatched service or a vulnerable protocol. A hardware security key is an optional implementation for compatible systems; verify support with the identity provider, VPN, device, and organizational policy before purchasing one.
Monitor both incoming and outgoing traffic
Log and review ingress for scanning, repeated authentication failures, unexpected countries or networks, and access to unusual ports. Monitor egress for command-and-control patterns, unexpected destinations, large transfers, and a public server initiating connections that its role does not require. Monitoring should produce an alert path and an owner, not merely collect data.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 4: Keep management interfaces private
Management interfaces include web consoles, SSH, remote desktop, device APIs, hypervisor panels, database administration ports, and out-of-band controllers. CISA’s network-device guidance says to manage devices only from trusted devices on trusted networks. Do not publish an administrative interface simply because the public application must be reachable.
A safer management path
- Remove the management interface from public addressing and public DNS.
- Permit management only from a dedicated administrative network, private connection, or VPN.
- Require multifactor authentication at the access gateway and on the device when supported.
- Route sessions through a monitored jump host and log administrative activity.
- Restrict the set of administrators and source devices with ACLs or equivalent policy.
- Review the path after every network or cloud change and during routine exposure assessments.
Federal Civilian Executive Branch agencies are subject to Binding Operational Directive 23-02, which requires removal of exposed management interfaces or protection with separate zero-trust policy enforcement. The directive is binding on those agencies; it is not a universal legal requirement for every organization. CISA recommends that other stakeholders review and adopt the underlying risk-reduction practices.
Step 5: Segment public services from internal systems
Place public-facing services in a DMZ
Externally facing DNS, web, and mail servers should be placed in a demilitarized zone (DMZ) or equivalent isolated network. Permit only the flows required between the DMZ, internal services, and the internet. A compromised web server should not provide a direct route to employee workstations, identity systems, backups, or control networks.
Separate groups of devices
Use network segmentation to separate servers, user devices, management systems, security tools, and specialized equipment. Limit east-west traffic between segments and require an explicit, logged rule for each necessary connection. Segmentation reduces blast radius; it does not remove the need to patch and monitor every exposed service.
Protect industrial and control systems
For industrial control systems and other operational technology, minimize network exposure and keep systems off the public internet. Place them behind firewalls, isolate them from business networks, and permit only the communications required for operation and maintenance. Remote maintenance should use a controlled, monitored path rather than a directly published control-system interface.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Zone | Typical contents | Design objective |
|---|---|---|
| Internet | Untrusted external users and networks | Expose only explicitly approved service endpoints. |
| DMZ | Public DNS, web, and mail services | Contain compromise and tightly control connections inward. |
| Management | Jump hosts, administrative tools, device consoles | Reachable only from trusted administrator devices and networks. |
| Internal business | Applications, identity services, user systems, and data | Prevent direct access from public services and constrain lateral movement. |
| Control or operational | ICS and other safety- or process-critical systems | Keep off the internet, isolate from business networks, and allow narrowly defined maintenance paths. |
Step 6: Disable unnecessary or unsafe services and protocols
Every listening service adds a potential attack surface. Remove services that are unused, obsolete, or not required for the device’s role. CISA’s communications guidance identifies the following examples for disabling when they are not necessary:
| Service or protocol | Why it is a concern | Hardening action |
|---|---|---|
| Telnet | Legacy remote administration with weak protection and commonly plaintext credentials. | Disable it; use a supported, encrypted administrative method on a private management path. |
| FTP | Legacy file transfer that may expose credentials or data without adequate encryption. | Disable it when unused and replace required transfers with a supported secure method. |
| TFTP | Minimal file-transfer protocol with little or no authentication. | Disable it unless a documented device function requires it; restrict any remaining use tightly. |
| SSH version 1 | Obsolete protocol version with weaker security properties. | Disable version 1 and use a supported protocol version on a restricted management network. |
| Unneeded HTTP servers | A plaintext web service may expose credentials or an unnecessary administration surface. | Turn off the server when not required; protect required web services with current secure configuration and network restrictions. |
| SNMP versions 1 and 2c | Legacy monitoring versions can expose community strings and lack modern protections. | Disable when possible; if monitoring requires them, restrict sources and evaluate a supported, stronger alternative. |
Do not disable a protocol blindly on a production device. Confirm dependencies, schedule the change, test the required function, and verify from an authorized external perspective that the unwanted listener is closed.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Harden VPN gateways too
A VPN is a way to reduce public exposure, not an exemption from hardening. Minimize the VPN gateway’s exposed ports and features, use strong cryptography, disable unused algorithms and functions, and keep the product current. CISA’s industrial-control advisories caution that VPN products can themselves contain vulnerabilities, so a VPN gateway belongs in the internet-facing patch and monitoring program.
Step 7: Scan, monitor, and reassess continuously
Exposure changes whenever a cloud resource is created, a firewall rule is added, a certificate is issued, a vendor connects remotely, or a device is replaced. CISA recommends establishing routine assessments rather than treating one scan as a permanent result.
Use a recurring control cycle
- Discover: scan authorized public ranges, cloud accounts, DNS, and known service providers for reachable assets and unexpected ports.
- Validate: assign each finding to an owner and confirm whether the service is legitimate, supported, and required.
- Prioritize: address exposed known-exploited vulnerabilities and public management interfaces first, then other weaknesses and unnecessary listeners.
- Remediate: remove exposure, patch, replace, restrict, segment, or apply a documented temporary control.
- Verify: rescan from outside, test the business function, and confirm that the intended management path still works.
- Monitor: review ingress, egress, authentication, configuration, and vulnerability alerts for signs of drift or attack.
- Repeat: reassess after major changes and on a routine schedule appropriate to the organization’s risk.
Discovery platforms and vulnerability scanners provide visibility and assessment. They do not automatically remove a firewall rule, patch a device, establish ownership, or prove that an asset is safe.
What to do when a scan finds unexpected exposure
An unknown device or service appears
Preserve the finding, identify the address and owner, and compare it with firewall, cloud, DNS, and asset records. If the service has no valid purpose, remove the route or rule and verify that no dependent process breaks. If ownership cannot be established quickly, treat the exposure as an operational risk requiring an accountable decision rather than leaving it open indefinitely.
A public device is unsupported
Do not wait for a patch that will never arrive. Restrict it to a trusted network, place it behind a controlled gateway if that genuinely removes public reachability, or replace it. A temporary isolation measure should have an owner and an end date.
A required service cannot be patched immediately
Reduce reachability with ACLs, remove unnecessary features, place administration behind a jump host, enable available multifactor authentication, increase monitoring, and schedule the update or replacement. These are compensating controls, not a permanent substitute for a supported system.
Removing a port breaks an application
Restore only the minimum required connection, document the dependency, and redesign the path so that the application does not require broad public access. Segment the service, restrict source networks, and assign a review date for the exception.
The VPN gateway itself has a vulnerability
Apply the vendor’s supported update or mitigation, reduce exposed features and ports, review active accounts and sessions, and check whether the gateway’s management plane is separately restricted. If the product is unsupported, accelerate replacement rather than treating the VPN label as a security guarantee.
A practical hardening checklist
- Every public address, hostname, port, service, and management interface has an owner and business purpose.
- Unneeded public exposure has been removed, with dependencies checked before the change.
- Default credentials, unused accounts, old keys, and unnecessary administrative paths are disabled or replaced.
- Internet-facing software and firmware are supported, current, and prioritized for known exploited vulnerabilities.
- Unsupported devices have a funded replacement or an isolation plan with a deadline.
- Public DNS, web, and mail services are isolated in a DMZ or equivalent architecture.
- Management interfaces are reachable only from trusted networks or devices through a monitored path.
- Multifactor authentication is enabled wherever the relevant systems support it.
- Telnet, FTP, TFTP, SSH version 1, unnecessary HTTP servers, and SNMP version 1 or 2c are disabled when not required.
- VPN gateways expose only required ports and features, use strong cryptography, and receive timely updates.
- Ingress, egress, authentication, and configuration changes are logged, monitored, and assigned to an alert owner.
- External scans and configuration reviews are repeated after changes and on a routine schedule.
Controls that reduce risk but do not guarantee safety
No single control prevents every remote exploit. Multifactor authentication helps with stolen credentials but does not fix a vulnerable service. A VPN can reduce who reaches a system but can itself be attacked. A scanner can reveal exposure but cannot establish ownership or remediate it. Segmentation limits the blast radius but does not make an exposed device trustworthy. The durable strategy is layered: reduce public reachability, harden what remains, separate trust zones, remove weak protocols, patch quickly, and verify the result continuously.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
