CONFIDENTIAL
Prepared by CyberSafe.Now
Program evidence for Northwind Creative Co.
This section lists required controls whose finding is fail as of this snapshot. The list is empty when no required control is failing.
Failed required controls: 1
This section lists required controls whose finding is fail as of this snapshot. The list is empty when no required control is failing.
This section lists each TCP port the public-hostname check fails, and why, then the latest scan of the subscribed hostname.
Each week we try to connect to these TCP (Transmission Control Protocol) ports on your public hostname. An open port fails the check. We record that the port accepted a connection. We do not see whether a password is set, and we do not name a software bug.
Remote login and file sharing
These should accept connections from a known network, not from the whole internet.
| Port | Service | Why it fails |
|---|---|---|
| 21 | FTP (File Transfer Protocol) | Sends passwords and files without encryption. |
| 22 | SSH (Secure Shell) | A remote command line. It should not accept logins from the whole internet. |
| 23 | Telnet | A remote command line with no encryption. The same class of exposure as FTP. |
| 445 | SMB (Windows file sharing) | Windows file sharing. Ransomware campaigns scan the internet for this port. |
| 3389 | RDP (Remote Desktop Protocol) | Windows remote desktop. It is scanned constantly and is a common ransomware path. |
| 5900 | VNC and Apple Screen Sharing | Remote screen sharing. Attacks have used Macs whose port 5900 was reachable from the internet. |
| 5985 | WinRM (Windows Remote Management) | Remote PowerShell. Port 5985 is the default HTTP listener when this service is on. |
| 5986 | WinRM over HTTPS | The same remote-management service as port 5985, with encryption. |
Windows services on a server or domain controller
Microsoft documents these as the listeners for directory services. They do not belong on the public hostname.
| Port | Service | Why it fails |
|---|---|---|
| 88 | Kerberos | Domain login. A domain controller listens here by default and should not be published on the public hostname. |
| 135 | Windows RPC (Remote Procedure Call) | Windows listens here by default. Microsoft’s guidance for directory bugs is to refuse this port from networks you do not trust. |
| 139 | NetBIOS session | Older Windows file sharing. It is the companion to port 445 when file sharing is on. |
| 389 | LDAP (Lightweight Directory Access Protocol) | The directory of users and computers. A domain controller listens here by default. |
| 464 | Kerberos password change | The service that changes domain passwords. A domain controller listens here by default. |
| 636 | LDAP over TLS | The same directory as port 389, with encryption. Encryption does not make it safe to publish. |
| 3268 | Active Directory Global Catalog | The catalog of accounts in an Active Directory forest. A domain controller listens here by default. |
| 3269 | Active Directory Global Catalog over TLS | The same catalog as port 3268, with encryption. |
| 9389 | Active Directory Web Services | The management API for Active Directory. It is installed with a domain controller. |
Databases and data stores
An open port fails the check. The scan does not see whether a password is set.
| Port | Service | Why it fails |
|---|---|---|
| 1433 | Microsoft SQL Server | The default SQL Server port. Internet scanners try passwords and then run commands on the computer. |
| 3306 | MySQL | A database. Copies left open on the internet are brute-forced and have been wiped for ransom. |
| 5432 | PostgreSQL | A database. A trust rule or a weak password on an internet-facing copy is a full login. |
| 6379 | Redis | An in-memory database. Internet-reachable copies have been used to run commands on the host, including through CVE-2022-0543 on Debian and Ubuntu packages. |
| 9200 | Elasticsearch | A search database. Open copies have been wiped for ransom, and CVE-2015-1427 in this service is on the known-exploited list. |
| 27017 | MongoDB | A document database. In 2017, internet-reachable copies with no login were wiped and held for ransom. |
Ports 80 and 443 are your website, and port 25 is mail. An open website or mail port does not fail this list. DNS (the Domain Name System) is not in this list. We do not probe UDP (User Datagram Protocol) ports, such as the SQL Browser or NetBIOS name service.
Target: northwind.example — Pass ·
Open ports: 80, 443
Port 443: Pass · TLS 1.3 · expires in 64 days
This section reports the latest connector findings for identity and SaaS controls on the subscribed platform.
Platform: Google Workspace · last sync
| Control | Finding | Evidence |
|---|---|---|
| Multi-Factor Authentication (MFA) Enforced for All Users | Pass | Users without MFA: 0 |
| Super Admin Count Within Policy | Pass | Super admin count: 2 |
| Drive External Sharing Posture | Fail | Sharing capability: External allowed |
This section records the declared backup method, compliance evidence archive status, and data-backup policy review state.
Compliance evidence archive: Enabled
Backup method (declared): Cloud vendor
Last evidence pack:
Data backup policy past due for review: No
Evidence pack contents: Tenant exports, report snapshots, and connector metadata
Active devices: 8 / 8
Last sync:
This section lists staff reviews and company policy uploads on file, with review-due dates where recorded.
| Policy | Uploaded by | Date | File |
|---|---|---|---|
| Data backup policy | Dana Ortiz | data-backup-policy.docx | |
| Incident response policy | Dana Ortiz | ir-policy.pdf |
Assure Plan expects 12 company policies. 2 are on file.
| Policy | Required | Provided to CyberSafe.Now | On file |
|---|---|---|---|
| Dual control for payment changes | Yes | No | — |
| Acceptable use policy documented | Yes | No | — |
| Data handling and classification policy documented | Yes | No | — |
| Password and access control policy documented | Yes | No | — |
| Information security program policy documented | Yes | No | — |
| Incident response policy documented | Yes | Yes | ir-policy.pdf |
| Remote work security policy documented | Yes | No | — |
| Third-party and vendor risk policy documented | Yes | No | — |
| Data backup policy documented | Yes | Yes | data-backup-policy.docx |
| Backup and business continuity policy documented | Yes | No | — |
| Security awareness training policy documented | Yes | No | — |
| Generative AI acceptable-use policy documented | Yes | No | — |
This section lists company policies on the current plan that have no adopted upload. Required policies in this list have no file on record.
| Policy | Control | Required |
|---|---|---|
| Dual control for payment changes | Dual Control for Payment Changes | Yes |
| Acceptable use policy documented | Acceptable Use Policy Documented | Yes |
| Data handling and classification policy documented | Data Handling and Classification Policy Documented | Yes |
| Password and access control policy documented | Password and Access Control Policy Documented | Yes |
| Information security program policy documented | Information Security Program Policy Documented | Yes |
| Remote work security policy documented | Remote Work Security Policy Documented | Yes |
| Third-party and vendor risk policy documented | Third-Party and Vendor Risk Policy Documented | Yes |
| Backup and business continuity policy documented | Backup and Business Continuity Policy Documented | Yes |
| Security awareness training policy documented | Security Awareness Training Policy Documented | Yes |
| Generative AI acceptable-use policy documented | Generative AI Acceptable-Use Policy Documented | Yes |
This section reproduces the extracted text of an adopted company policy. CyberSafe.Now retains this extract; original PDF or Word bytes are not stored.
Northwind Creative Co. data backup policy.
Production tenant exports are copied monthly to encrypted object storage.
Dana Ortiz reviews restore tests each quarter and records the result.
Backup media leaving the office require dual custody.
This section reproduces the extracted text of an adopted company policy. CyberSafe.Now retains this extract; original PDF or Word bytes are not stored.
Northwind Creative Co. incident response policy.
Staff report suspected incidents to Priya Shah within one hour.
Do not wipe devices before insurer approval.
The owner notifies CyberInsure Claims at 1-800-555-0142.