[Start of recorded material 00:00:00]
Phil Brown: Hi, it’s Phil Brown and I’m here with David Whelan. And today we’re going to talk about ports.
David Whelan: If you listen to our other podcasts, you’ll have heard a little bit already about the network hardware like routers and modems that you’ll be using in your law firm to connect to the internet, to connect to the other devices in your practice. And ports are an important part of that that you may not – well, you’ll never see for sure but you may not really know is something you need to be thinking about.
Phil Brown: And every computer has a port and we’re not talking about the little holes on the back of the CPU.
David Whelan: Right. It’s not USBs, it’s not mice. The way I like to think about ports is that it’s part of your operating system, so whether it’s the operating system on your phone, on your computer, on your router, each one of those has software that handles these things called ports.
And if you think about ports as like as a big sieve that you would have used at the beach where it’s got lots and lots of little holes in it, that’s exactly what happens with ports is that each device you have has a ton of these little holes that are available for applications to communicate through. And the easiest way to describe it is probably talking about the web.
When you go and access a website, you go to lsuc.on.ca and listen to our great podcasts or you go to CNN.com, you’re actually going to a website computer that is listening on port 80. And that is the standard port for every website. So if you go to a website.com or whatever, it will be on port 80.
And your computer can be set up or your phone can be setup to listen on port 80 as well if you wanted to run a web server off your phone. But there are many, many other ports that are also available to be used and in some cases are turned on by default depending on how you’ve configured your phone and your computer.
Phil Brown: And that’s one of the things we’re getting at today is it’s a good idea to know which of these ports are open and actively listening for a signal from somewhere on the internet.
David Whelan: Yes. There’s a great website if you can use it and this is probably best tried from home depending on where you’re working, it might work or it might not but it’s called ShieldsUp grc.com and it will do what’s called a port scan and port scans are actually happening all the time to your computer to your firms, firewall to your firm’s routers by hackers and other people who have automated these scans because they’re looking to see which ports are open.
So the one of the good things you can do is to figure that out yourself. And so do a scan and it should tell you which of these ports you have open, it might tell you you’ve got port 21 open, which is used for file transfers. You might have port 25 open, which is for sending email using the SMTP protocol.
You might have port 80 open, you may have a port open on Windows computers because you’re using Windows file sharing and it’ll be – it’s not RDP but it’s in the hundreds, I believe. So you may start to see that there’s actually a bunch of different ports that these ports scan find.
Phil Brown: And it might be a good idea either on a home network or a business network to close a few of these ports. For instance, if there’s a port open for an SMTP or pop3, one of those ports and you don’t want email going back and forth when you’re not there for instance.
And we talked in another podcast about setting up different times of day to allow certain types of traffic. Is this something you could gear through your firmware so that your ports will only open at certain times of day?
David Whelan: You can do that and I think really the most important takeaway with ports is, you shouldn’t have any ports open that you aren’t actually using for something. And we often see this when we – in the library --we deal with law firms and they have closed down all port access in and out of their network other than port 80.
And so sometimes they’ll go to the library catalogue and the library catalogue flips them over to a different port because although it’s a web server, it’s listening on a port other than port 80, which is a normal one. And so we’ll get a comment from a lawyer, “I can’t reach your catalogue because my firewall is blocking it.” And what that means is that firm has really locked it down so that they know everything that’s going on and they’re only allowing standard web traffic.
And so if you have non-standard web trafficking even let alone emails and files being trying to transfer through, they’ve turned off all of those. So if you find that you’ve got ports open or if you just start from scratch and go into your router or look at your computer and see that these things are turned on, you can just turn them off until you need them. It doesn’t mean that you can’t use email or have an email server or a file server, you just need to turn off the ports unless you know what’s going on.
Phil Brown: And this is not the easiest thing to do for the average person. I mean you have to do a little bit of reading on the internet first before you turn off something that shuts off all your email and you can’t send anything out or back, you can’t access the internet to figure out how to fix your problem after you’ve closed these ports. It’s a good idea to have a notepad and be ready to undo what you’re trying to do.
David Whelan: The good news is that although there are thousands of ports that are available, you really only need to worry about four or five and unless you are running an email server or a web server from inside your home or inside your office, you won’t even need to worry about those because really the only ones you’re going to need is web access.
And then you may need to open up access to that you can send and receive emails, but many of the email applications like Outlook, which talks to Microsoft Exchange or Thunderbird, which might talk to your pop3 or your iMac email, they can be configured to go through the standard ports that are open on a router or whatever available on your computer.
Phil Brown: And we talked about some enterprise software right out of the box might give access to a number of ports through your operating system you would normally want to have open.
David Whelan: Yeah, that’s tricky because if you’re a solo or small firm lawyer and you haven’t hired a technology person to help you get started and you’ve bought a new computer that’s running Windows server or something else, there’s a good chance that it’s actually – it’s been configured by default to be easy for you to set up, which means that it’s also easy for other people to access.
So the tricky thing can be that you may have already secured your router, which is your connection to the internet. But you then need to secure each of the computers that connects to it as well. And so that server could have ports that are open your Windows desktop or your Windows laptop could have ports that are open and that’s where talk of using firewalls and things to be double protection can help but really the first step is to just turn off anything you’re not really planning to use.
If your new computer comes with a web server, that’s great, it’s kind of cool. But if you’re not going to use it, disable it, block the port so that people can’t access your web server.
Phil Brown: And this might be a good time to mention we’ve done a podcast about tech audits. Maybe it’s good time to do a tech audit each time you add a piece of hardware or software to your network.
David Whelan: That’s an excellent suggestion. And I would even say when you’re using apps and adding additional applications to your devices, phones, tablets, whatever, it’s amazing what an app will want to access for you or the services that it will set up without even realizing it.
And I was joking earlier about Goat Evolution. But I have a firewall on my phone and my kids use Goat Evolution. And it actually tried to get past the firewall and I wouldn’t have known that had I not known to block whatever it was trying to do.
So I think it’s a good thing to do that periodic tech audit to say, “You know what, you’ve brought new hardware into the firm, what is it actually doing beyond the basics of what you intended it to do?”
Phil Brown: And I think that’s another important thing is we’ve talked about having policies for your firm in regard to the use of hardware and software within a firm. And I think that’s another takeaway is to make sure you have a policy and enforce a policy in regard to what people are allowed to plug into their devices in the office. Can they bring a USB from home and plug it into the network? Because often that can be a transmission route for other things.
David Whelan: And this isn’t high tech stuff. You can Google ports and it may not be immediately understandable what it means, but you can easily get into a routine and set up a process within your firm, put it in your calendar for every year for the next 20 years as long as you’re going to practice whatever you can do it right today and set up that appointment so that on an annual basis, you go back and look at all the devices and all the things that you’ve done.
You may not have added very much or changed very much over a year. But you can at least go through and say, “Okay, what has changed? Am I doing anything differently today from what I was doing a year ago and how will that impact my network in particular?” And I think ports in particular on your network are – they’re open holes until you close them.
And we’re getting better at seeing the hardware and the software that comes into law firms, starting out with all those holes closed and having to open them up. But if you aren’t aware of which holes are open, you can really make your law firm exposed to anybody who’s looking around.
Phil Brown: Right. So it’s a good idea to sort of examine things and as we said with each piece of hardware or software, just get a look at what you’re now allowing that you may not have allowed in the network before.
David Whelan: Right.
Phil Brown: That’s our look at ports. Thanks very much, David.
David Whelan: Thanks, Phil.
[End of recorded material 00:10:08]