External Assets

Open

External Scan Example

Visit our YouTube Channel for more video content: https://www.youtube.com/@connectsecure

Table of Contents

External Assets - Details

Access the External Assets from the Assets category.

Open

Configurations

Add

This is where you add the external asset(s) for the company you want to scan. Tap on the Add button next to external scan endpoints.

Open

Open

Field Name	Description / Use Case

Field Name	Description / Use Case
Name	Give the record a name of your choice
Address Type	Choose between Static IP, Domain, or IP Range
Scan Profile	Designates which scan profile to use for the external scan; this controls the number of ports being scanned. See the table below for the details of the scanning profiles. Open
Ignore Ports, even if they are open	When a port is added to the Ignore Port list, it is not excluded from scanning. Instead, it is treated as a known secure port, which means it does not impact the overall risk score. These ports are still scanned for vulnerabilities, and any identified issues will be reported in the portal as usual.
Tags	Used to add Auto Tags to the External Asset(s)
Exclude from scanning	Select to exclude from scanning
Scan Later	Select to scan later manually or based on the scheduler; otherwise, the scan will initiate as soon as it’s saved

Edit / Remove

Use the three-dot Action menu to Edit, Remove, or Scan existing records.

Open

Bulk Upload

Tap the upload icon to download and obtain the bulk upload template.

Open

Profiles

This is where you can manage Custom Profiles, with options to Add, Edit, or Delete. This includes the Name, Profile Type, Ports, Protocol, and Service Detections.

Open

Results

This is where you view your results from the external scans.

Open

The table view shows critical vulnerability data, security grade, risk score, user information, and more. The column view and reorder options allow you to set and reorder the table view.

Open

Column data includes the following options:

Tap on the IP to see additional details about the scan.

Open

Tap on the Risk Score Letter Grade to see the score breakdown.

Open

From Open Ports, menu action, user can use “Close Open Port Ticket” ability.

• If no ticket exists for the selected port, a popup will appear stating: “No open ticket found for the port.”

• If a ticket exists, it will be successfully closed.

Open

Open

Tap on the format icons to print out the External Scan standard report.

Open

Ports

Open

In the context of external scanning, a "filtered" port indicates that the scanner did not receive any response from the target when probing that port, and therefore cannot determine whether it is open or closed.

This typically happens when:

• A firewall, WAF, or network security device is actively blocking or silently dropping incoming traffic from the scanner

• The target system is configured to not respond to unsolicited external requests

• Cloud/network controls (e.g., security groups, ACLs) are restricting access from external sources

From an external scan perspective:

• Closed ports → Respond with RST / ICMP unreachable

• Open ports → Respond normally (service accessible)

• Filtered ports → No response at all (traffic dropped/blocked)

So, a filtered state does not confirm the port is open or closed, but rather that it is inaccessible from the scanner’s external vantage point.

Key takeaway:

Filtered = The port is being blocked externally, so its actual state cannot be determined from outside the network.

This is commonly expected in secured environments where external access is restricted.

What Happens During An External Scan

Phase 1 — Discovery

The scan first performs a lightweight Nmap discovery sweep against the target IP range using the top common ports to identify which hosts are alive and reachable.

Phase 2 — Port Enumeration

Once active hosts are identified, Nmap performs a SYN scan (-sS) against a larger port set (top ~3000 ports) to determine which ports are open on each host.

During this stage, additional metadata may also be collected, including:

• Hostnames

• NetBIOS/NBT information

• MAC address details (when available)

Phase 3 — Advanced Service & Vulnerability Scanning

After open ports are identified, the scan proceeds with deeper enumeration using advanced Nmap capabilities, including:

• Service version detection (-sV)

• OS fingerprinting (-O)

• Aggressive scan options (-A)

• NSE vulnerability and discovery scripts

The scan also evaluates:

• SSL/TLS configurations

• HTTP/HTTPS services

• SSH configurations

• Known vulnerable services

• Weak ciphers and algorithms

• SSL certificate details

• Web server banners and security headers

For some asset types (such as printers), specialised checks are performed separately.

Phase 4 — Vulnerability & Script Processing

The NSE script results are parsed and correlated against known vulnerability patterns and CVE mappings. This includes:

• Vulnerability identification

• SSL cipher grading

• Weak SSH algorithm detection

• HTTP security header analysis

• SSL certificate validation

• Service fingerprinting

Phase 5 — Supplemental Checks

Additional validation steps may run depending on the discovered services, including:

• Security header validation

• Additional service fingerprinting

• Web plugin/banner detection

• Network-level fingerprinting

• Targeted vulnerability checks against open services

Phase 6 — Result Processing & Publishing

Finally, all collected information is consolidated and published to the platform, including:

• Open ports

• Detected services

• Vulnerabilities/CVEs

• SSL findings

• OS information

• Fingerprints and banners

• Asset metadata

Once processing completes successfully, the scan task is removed from the processing queue.

External Assets - Toolbar Options

Open

Jobs

Tap to view the jobs data.

Open

Alerts

View our timeline style of System Events captured for each company. You can set an optional date filter range to target a specific date range of events.

Open

Info

Tap here to view your V4 Getting Started Info.

https://cybercns.atlassian.net/wiki/x/MIDKfw

Refresh Risk Score

Refresh Risk Score quickly recalculates an asset’s risk rating using the latest vulnerability and scan data, ensuring the score reflects its current security posture.

Open

Help Link

Click to access the related documentation page; this link is functional on all screens and will take you to the appropriate documentation page.

Layout Settings

Here, you can change the UI look and feel using various options, including the Theme for color, the Scheme for dark and light mode, the Layout for toolbar and module positions, and the toggle to set the table view default.

Open

FAQ - Frequently Asked Questions

External Scan – Static IP Routing

Our External Scan infrastructure is migrating to a dedicated static outbound IP address for all scan traffic. This change removes the need for customers to repeatedly update firewall allowlists whenever scanner IP addresses change.

To obtain the correct IP address for whitelisting, log in to your ConnectSecure platform and navigate to the INFO section. Click VIEW to access your POD-specific details, which includes your NAT Communication External Scan and other relevant information.

Quick Reference

Detailed Q&A

What needs to occur?

Add static IP address to the allowlist on any firewall, WAF, IPS, geo-filter, or other access control mechanism that may block vulnerability scanning traffic originating from our platform.

What direction is the traffic we need to allowlist?

Inbound. The scanner initiates connections from static IP address to your externally accessible assets — you need to allow inbound traffic from that IP. No outbound rule changes are needed on your side.

Do I need to allow all traffic inbound from that address?

Yes. The scanner initiates connections from static IP address to your externally accessible assets. Your firewall should permit inbound connections originating from this IP to the services you want scanned.

Do I need to allow outbound traffic?

In most cases, no. The scanner initiates the connection, and standard return traffic for established sessions is handled automatically by stateful firewalls.

What protocol(s) are we supposed to allow? (TCP, UDP, ICMP, etc.)

TCP, UDP, and ICMP. Allowing all three ensures full scan coverage — ICMP supports host discovery, while TCP and UDP cover service-level scanning. Restricting to TCP only can result in incomplete scan results.

Is it for all ports, or specific ports?

All ports (1–65535). We recommend allowing the IP to access every port you want assessed during the external vulnerability scan, since external scans evaluate the full port range by default.

How can I test that it's working?

After updating your firewall rules:

• Review firewall logs to confirm connections from static IP address are being accepted rather than denied.

Can I keep my existing scanner IPs allowlisted?

Yes, This is in addition to existing IPs. During the transition period, your existing allowlist entries can remain in place. We recommend also adding the new static IP now to ensure uninterrupted scanning going forward. Existing scanner IPs will be required and then deprecated in September, once we've confirmed all customers have migrated to the new static IP.