We audited our PC and network — and found settings we only thought we had
What this post is (and isn't) In the previous post , we sorted what you need to protect onto five shelves. This post is a record of how we actually reviewed two of them — "devices" and "just in case" — in our own environment. In October 2026 we reviewed Exapolicy's environment in three layers. There is nothing special about it: it is built around the kind of broadband router you would find in any…
In October 2026, Exapolicy conducted a thorough review of its PC and network settings, discovering several potential vulnerabilities in their environment. The assessment encompassed two layers: the development environment and the office infrastructure.
In the development environment, which consisted of a personal computer (PC) and a development server, several issues were identified. File shares were left open to everyone, meaning that if a password leaks, the entire LAN could be compromised. The development server was also reachable from any device on the LAN without any authentication, allowing any device on the LAN to run, delete, or replace models.
Remote access accepted connections from anywhere, providing more entry points for attackers. Lastly, Tamper Protection was disabled, which puts the PC at risk of ransomware attacks by disabling antivirus software.
Within the office infrastructure, which included a router, a network-attached storage (NAS) device, and a printer, the assessment revealed several concerns as well. Inbound app permissions were active on public networks, meaning that someone on a shared Wi-Fi network could access these apps with the same level of access as the user. Additionally, the backup target was always connected and writable, meaning that if the PC were taken over by ransomware, both the PC and the backup would be encrypted at the same time.
Exapolicy implemented various corrective actions to address these vulnerabilities. In the development environment, Tamper Protection was enabled, the guest account was disabled, file share permissions were limited to the owner and administrators, and remote access was restricted to the office LAN and VPN range. In the office infrastructure, firmware updates were set to update automatically, the admin password and port forwarding were checked, WPS was turned off, and admin access from the internet side was disabled.
However, Exapolicy discovered two significant gaps in their settings. First, backup snapshots had stopped on one volume around two years ago, despite the schedule being in place. This meant that the volume had no point to roll back to, leaving it vulnerable to ransomware attacks. Second, a setting that exposed the development server to the LAN was removed and rebooted, but it was still reachable from the LAN.
This highlights the importance of checking the actual state of settings after making changes, rather than merely verifying the existence of a scheduled task.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
