Finding device interfaces
A probe can reveal a camera, printer, or connected device service behind an otherwise protected application.
Industry blocklist
Internet of Things blocklist
Protect fleets of reachable devices through a shared edge rule when individual devices are difficult to monitor or update.
The coverage
What our sensors observed
Our sensors saw probes against cameras, printers, connected devices, home automation, and the services used to manage them. The mapping covers device interfaces that may remain exposed even when a central application is protected.
Why use this feed
A camera, printer, or connected controller may have little useful logging, and updating every device can take time. Put the source list on the gateway in front of those endpoints so the firewall handles observed scanners in one place. This is especially useful across several sites with the same exposed device service. Keep approved viewers, controllers, and management clients in the access review.
The challenges
Scanning can reveal a reachable service before an exploit attempt, whether a flaw is known or still undisclosed. Our sensors record sources doing that probing. A firewall rule using the feed can deny a listed source before its next connection reaches your service, without needing to recognize the exploit itself.
Unpatched devices in reach
If an exposed device has a flaw, later traffic can target it while the fleet is still waiting for an update.
The gateway sees it first
A feed at the gateway can deny a listed source before individual devices have to record or handle its next connection.
Edge enforcement
Defend your edge
The feed loads matching rules into your firewall. Listed sources are intercepted before crossing the edge; traffic with no match continues to your services.
Where this feed fits
Use the observed source list where your existing edge controls meet these reachable services.
Filter observed scanner sources at the gateway in front of reachable camera streams. Review the rule against viewers who have approved access.
Place the list in front of management interfaces that can be reached from outside. Keep operator access limited by separate rules.
Use a shared firewall rule around exposed printer services rather than expecting each device to maintain its own block list.
Apply the feed at the gateway serving connected home controls. Check that approved controllers can still reach those services.
Review the list where connected devices send or receive messages across the edge. Account for the clients that must stay connected.
Send one updated list to the gateways at each site. This avoids collecting scanner addresses from devices that have little or no useful logging.
Industry blocklist
Start blocking observed scanner sources.
Choose this industry, connect the feed to your firewall, and review access with the people who run each service.