DEV Community

facilishz
facilishz

Posted on

An Exposure Inventory Playbook for Critical Infrastructure Patching Programmes

#security #geoserver #cve202436401 #attacksurface

An Exposure Inventory Playbook for Critical Infrastructure Patching Programmes

The CISA advisory AA25-266A describes an intrusion at a federal civilian executive branch agency, but the failure mode it documents is not specific to government. A public-facing service ran an unpatched remote code execution flaw, the asset was reachable from the internet, detection depended on a control that did not cover every host, and the response plan had no procedure for bringing in outside help. Any regulated operator can reproduce that pattern.
This article turns the advisory's findings into an inventory routine, using the same measurement approach that produced the exposure figures below.

Step one: know which of your services must be public

The first question is not which vulnerabilities exist. It is which of your systems has a business reason to accept connections from the internet. GeoServer is an instructive example because its exposure is usually intentional: publishing geospatial data to external users is the product's purpose. The defensible position is not "nothing public" but "public by documented exception."
For each public listener, record the owning team, the data classification of what it serves, the intended audience and the last review date. Anything without an owner is an orphan, and the advisory's incident began on two instances of a single product that were both reachable.

Step two: measure the surface independently

Inventory databases drift. An external view of the same estate catches services that were stood up during an incident and never registered. A product fingerprint search scoped to your own address space or autonomous system gives that independent view.
The global figures from 2026-09-29 show what a fingerprint search yields at scale and how narrow the subsets become:
| Query | Exact count |
| --- | --- |
| app="GeoServer" | 57,663 |
| app="GeoServer" && service="http" | 47,664 |
| app="GeoServer" && port="8080" | 9,770 |
| app="GeoServer" && port="8443" | 625 |
| app="Apache Tomcat" | 581,630 |
The port="8443" count of 625 shows how much a single filter reduces a population. Applied to your own network, the same narrowing turns an unmanageable list into specific hosts to verify.

Step three: reconcile and classify

Three outcomes are possible for every discovered host, and each has an action.

  • Indexed and claimed by a team: confirm version and patch state, then decide whether public reachability is still justified.
  • Indexed and unclaimed: treat as a finding requiring investigation, because an unknown public service is exactly what an intrusion seeks.
  • Not indexed but claimed: this is the outcome to verify rather than assume, since a host can be absent from an index because it is firewalled or because coverage is partial.

Step four: close the monitoring gap

The advisory notes that the activity went undetected for three weeks and that one public-facing system lacked endpoint protection. Inventory work should therefore produce two outputs, not one: a reduced list of public services, and confirmation that each remaining public service is covered by a detection control whose alerts are actually reviewed.

Step five: rehearse the response

The third lesson in the advisory concerns the incident response plan. Practising the plan, and pre-agreeing how external parties are engaged and granted access to security tooling, converts a document into a capability. For critical infrastructure operators, the equivalent rehearsal is an exercise that combines the asset inventory, the detection coverage map and the escalation path in one scenario.

Conclusion

Nothing in this routine depends on knowing whether a specific instance runs an affected version. That is the point. The inventory determines what is reachable, the reconciliation determines what is unexpected, the coverage check determines whether an intrusion would be seen, and the exercise determines whether anyone can act at three in the morning. The advisory's three weeks of undetected dwell time is the cost of skipping any one of them.

References

Top comments (0)