What This Alert Means.
This alert means an asset linked to your organization can be reached from the internet, but it is not in your inventory. Shadow IT is any system or service set up without the knowledge of the IT or security team. The alert covers forgotten subdomains, cloud assets and open ports. An open port is a network door that accepts connections from outside.
The NCSC describes external attack surface management as identifying, monitoring and reducing vulnerabilities within assets that are accessible from the internet. It lists forgotten domain names and IP addresses among the things such tools find, and services exposed to the internet that should stay internal. You cannot defend what nobody owns, so the first job is to find an owner.
First 24 Hours.
Treat every unknown asset as live and reachable until you prove otherwise. Work out what it is and who owns it, then reduce its exposure.
- SOC analyst Open the alert from the Brandefense asset discovery and shadow IT module and save the hostname, IP address, open ports and the date it was first seenKeep a copy before anything changes
- IT admin Check the asset against your inventory, DNS zone, cloud accounts and recent change ticketsA name that looks new may be an old record
- Cloud engineer Search every cloud account and billing report for the IP address or hostnameInclude test and personal accounts used for work
- SOC analyst Check what the asset answers on each open port, without logging inNote any login page, admin page or file listing
- Security lead Name one temporary owner so the asset is not left unattendedOwnership can be corrected later
- IT admin If no owner is found, cut access with a firewall rule or a security group ruleStopping access is safer than leaving it open
- SOC analyst Search logs for connections to and from the assetLook for logins, large transfers and unfamiliar addresses
- Legal Ask whether the asset holds personal data and whether anyone must be toldCheck with your legal counsel
Investigation Checklist.
These questions tell you whether the asset is harmless, forgotten or already in use by someone else.
- Does the name sit under your domain, or only point to your IP range?A forgotten subdomain may still carry your brand
- Which team, project or supplier created it, and when?Check DNS history, cloud audit logs and tickets
- Is the hosting account one the company owns and pays for?Staff may have used a personal card
- What software and version answers on each port?Old versions often carry known flaws
- Does it hold data, such as backups, files or a database?Decide how serious exposure is
- Is there any sign someone else has logged in or changed it?Check logs before you shut it down
- Does the DNS record point to something that no longer exists?That is a takeover risk
- Are other assets in the same account or network range also missing from the inventory?One find often leads to more
Containment And Removal.
A good first step is to agree which team is responsible for each asset and each risk, and then act on the findings. Removal here is done inside your own accounts and with your providers, not by a takedown request. Choose one of three outcomes for each asset: keep and secure, replace, or remove.
- Keep and secure: record the owner and purpose, add it to the inventory, patch it, close ports that are not needed and put admin pages behind a VPN or single sign-on.
- Remove: back up anything needed for records, then shut down the service and delete the hosting resource so it stops costing money and stops being a target.
- Clean up DNS: delete the DNS record that points to the asset. MITRE notes that DNS records pointing to resources that no longer exist can be taken over by attackers.
- Cloud provider or hosting provider: if the account is not yours, or you have lost access, use the provider's account recovery or abuse route and ask for the resource to be disabled.
- Registrar or DNS host: if the domain is not yours, ask the registrar to confirm the holder. Report it as impersonation if a third party owns a name that copies yours.
- National CERT: in Turkiye, report malicious infrastructure to USOM (usom.gov.tr). If you found evidence of intrusion, follow your own incident process and ask your legal counsel about reporting duties.
Longer-Term Hardening.
The aim is that no asset can appear without an owner. Build that into how teams work.
- Keep one inventory with named owners. Every domain, subdomain, IP range and cloud account gets a team and a purpose.
- Scan from the outside on a schedule. The NCSC says these tools show the attack surface as an attacker sees it, which is the view you need to compare with your own list.
- Search for shadow IT when a serious flaw appears. The NCSC advises checking known systems and shadow IT, using email security services and web proxy logs to spot unofficial installations.
- Set a decommission step. When a project ends, the checklist must include DNS records, certificates, cloud resources and accounts.
- Retire unsupported equipment. CISA's directive on end-of-support edge devices requires agencies to inventory such devices and decommission them on a set schedule. Private organizations can follow the same idea.
- Make it easy to ask. Give staff a quick way to request a server or an app, so they do not set up their own.
How To Measure That It Worked.
Track a small number of things you can count from your own records.
- The number of unknown assets found each month, and how many have a named owner.
- The gap between assets found from outside and assets in your inventory.
- How many days pass between first seen and a decision of keep, replace or remove.
- How many DNS records point to resources that no longer exist.
- Whether the same kind of asset reappears after cleanup.
Common Mistakes.
These errors let shadow IT grow back.
- Shutting the server down but leaving the DNS record, which can be taken over later.
- Assuming an old asset is harmless because it has no traffic.
- Giving the asset to nobody and closing the alert.
- Scanning only the domains you already know about.
- Blaming the team that built it, so the next team hides what it builds.
- Fixing the one asset and not looking in the same cloud account for others.
Questions.
-
What is shadow IT?
Shadow IT is any system, app or cloud service used for work without the knowledge or approval of the IT and security team. It is often set up in good faith to move faster, but nobody patches it or watches it, so it becomes an easy target for attackers.
-
How do I find who owns an unknown server?
Check your inventory, DNS records, cloud account audit logs, billing reports and change tickets. Ask the likely teams directly. If nobody claims it, name a temporary owner in security, restrict access to the server, and keep looking while it is no longer exposed.
-
Should I delete a forgotten subdomain?
Remove the DNS record once you confirm nothing needs it. MITRE notes that DNS records pointing to resources that no longer exist can be taken over by attackers. Check logs first, and delete the hosting resource and the record together.
-
Is an open port always a problem?
No. A web server needs ports 80 and 443 open. The problem is a port that nobody meant to expose, such as a database or admin service. Check what answers, who needs it, and close or restrict anything without a clear business reason.
-
How often should I look for unknown assets?
The NCSC describes external attack surface management tools as offering ongoing, continuous monitoring, not a one-off check. Pick a regular schedule that matches how often your teams create cloud resources and domains, and review new findings promptly.