Your internal dashboard is on the public internet

Someone on the team needed a dashboard, so they stood one up. A Grafana for the metrics, or a Jenkins to run the builds, or a router’s admin page for the office network. It was meant for internal use, it worked, and everyone moved on. In their heads it lives “on the internal network”, tucked safely behind the office walls.

The trouble is that “internal” is a belief, not a setting. A cloud migration moves the box to a public subnet. A firewall rule that was meant to be temporary never gets removed. A home-working setup forwards a port so someone could reach it from the sofa. In each case the dashboard quietly becomes reachable from the open internet — and because it still looks and behaves exactly as it did, nobody notices the door is now open to everyone, not just the team.

This is the quiet failure: a service that feels private, sitting in public, often still on the default admin / admin login it shipped with.

Why it stays invisible

Nothing breaks when a dashboard becomes public. It doesn’t slow down, it doesn’t error, it doesn’t send you a warning. From your desk it looks identical whether it’s reachable by five colleagues or by the entire internet. The exposure has no symptom — which is precisely why it can sit there for months.

Meanwhile, the internet is catalogued. Search engines like Shodan and Censys continuously scan every address on the internet and index what they find, including login pages for common admin tools. An attacker doesn’t stumble across your dashboard by luck; they search for “every Jenkins login page in the country” and yours is on the list the moment it’s reachable. Many of these panels are found still carrying their default credentials, because the person who set it up assumed nobody outside could ever see the login screen in the first place.

So the failure is doubly quiet: it makes no noise on your side, and it is actively easy to find on the other.

Find it yourself

You can see roughly what an outsider sees in about ten minutes. No tools to install.

1. Make a short list of the internal services you know exist — the dashboards, admin panels and build servers your team uses.
2. Find your organisation’s public IP addresses. If you’re not sure, ask whoever manages your hosting, or search “what is my IP” from the office network for the address you’re currently using.
3. Type internetdb.shodan.io/ followed by one of those addresses into your browser (for example internetdb.shodan.io/203.0.113.7). This free Shodan lookup shows what it has already indexed at that address — chiefly a short list of open ports. It’s terse, but you’re only looking for one thing: ports you didn’t expect to be open.
4. For the fuller picture — service names, login pages — create a free account at shodan.io and search for your organisation’s name or your domain. (Searching needs a login, and the net: filter that lists everything across a whole range, such as net:203.0.113.0/24, sits behind Shodan’s one-off paid membership — the free checks above cover the essentials.) Look for anything you recognise as meant-to-be-internal.

No command line to hand? The simplest check of all: from a phone on mobile data (not the office Wi-Fi, so you’re genuinely “outside”), type each dashboard’s address into the browser. If a login page loads, the wider internet can reach it too.

What you’re hoping to see is nothing — connections refused, timeouts, pages that don’t load. What you’re looking out for is any internal tool that cheerfully presents a login screen to the outside world.

The fix

The aim is simple: internal things should only be reachable from inside.

Take it off the public internet. The cleanest fix is to make the dashboard unreachable from outside altogether — put it behind the office network or a Virtual Private Network (VPN), so reaching it requires being on the network first. If a service genuinely must be public, put it behind a login you control (a reverse proxy with authentication, or your single sign-on) rather than exposing the tool’s own login page directly.

Change every default credential. Any admin / admin, admin / password, or blank login is an open door regardless of where the box sits. Replace them with strong, unique passwords, and turn on two-factor authentication if the tool supports it.

Close the ports you don’t need. Walk your firewall or cloud security-group rules and remove anything that opens a management port to the whole internet. “Temporary” rules have a way of becoming permanent; this is your chance to retire them.

Check yourself on a schedule. New services get stood up all the time, and each one is a fresh chance to leak. Re-running the phone-on-mobile-data check, or a quarterly look at Shodan, turns a one-off tidy-up into a habit — which is the difference between staying closed and quietly drifting open again.

None of this needs a security team. It needs someone to decide, once, that “internal” should be something you’ve configured rather than something you’ve assumed — and then to check it now and then.