BCN-T1-DAT-002Tier 1 · CriticalData Protection

Unauthenticated Database Endpoints

MongoDB, Redis, Elasticsearch, or similar services accepting internet connections with no authentication.

Remediation SLA: 24 hours
Tier: 1 · Critical
Domain: Data
Escalation: CISO and executive sponsor notified at 48 hours

What this finding is

A database or cache service is bound to a publicly-routable interface and either requires no authentication or accepts well-known default credentials. This affects data services whose historical defaults favoured convenience — MongoDB, Redis, Elasticsearch, Memcached, CouchDB, and Cassandra among them — particularly when deployed directly from a container image without configuration review.

Why it is Tier 1

This is the shortest path to total data loss in existence: connect and read. Automated campaigns have repeatedly swept the entire IPv4 space for these services, exfiltrating and then wiping databases in favour of a ransom note, and a newly-exposed instance is typically found within hours. Write access additionally permits data destruction and, in several of these engines, a path to code execution on the host.

Most common misclassification

Non-production instances are routinely downgraded. Development databases are commonly seeded with copies of production data and share credentials with production systems — classify by the data present and the credentials accepted, not by the environment label.

How to detect it

1Scan your external address space for the standard data-service ports (27017, 6379, 9200, 11211, 5984, 9042) and attempt an unauthenticated connection.
2Audit container and orchestration manifests for port publishing that binds a data service to the host's public interface.
3Check managed database instances for public accessibility flags, which are enabled by default in several provider consoles.
4Confirm whether authentication is enabled at all — several of these engines historically shipped with it disabled and preserve that default on upgrade.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1Remove public reachability first — bind to a private interface or withdraw the security group rule — because this closes the exposure in minutes.
2Enable authentication and create per-application accounts with scoped privileges; delete or disable any default account.
3Require TLS for client connections so that credentials are not recoverable from network capture.
4Assume compromise if the service was exposed without authentication: inspect for unexpected collections, ransom artefacts, and modified data, and follow the incident process.
5Add a preventive policy check in CI that rejects manifests publishing data-service ports on a public interface.

How to verify the fix

An unauthenticated connection attempt from an external host fails to establish, authentication is confirmed enabled in the running configuration rather than only in the intended config file, and the listener is bound to a private address.