Learn · How-to, Fixes · 7 min read

How to fix common security issues Torva finds

These are the findings Torva turns up most often on small-business networks, and how to fix each one. Most take minutes and cost nothing. Windows and IIS steps are included, since that's what many small offices run.

Outdated TLS versions (TLS 1.0 / 1.1)

These old encryption protocols are deprecated and fail PCI and modern browsers. On Windows/IIS, the simplest fix is the free IIS Crypto tool: apply the "Best Practices" template and reboot. That disables TLS 1.0 and 1.1 and enables strong ciphers. Then rescan to confirm only TLS 1.2 and 1.3 remain.

Missing HSTS header

Without HTTP Strict Transport Security, a visitor can be downgraded to insecure HTTP on a hostile network. In IIS Manager, open HTTP Response Headers for the site and add:

Name:  Strict-Transport-Security
Value: max-age=31536000; includeSubDomains

Only add includeSubDomains once you're sure every subdomain supports HTTPS.

No DMARC record

Without DMARC, criminals can send email that looks like it came from your domain. Start in monitoring mode by adding a TXT record and reviewing the reports for a few weeks before tightening the policy:

Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]

Once legitimate mail passes, move the policy from p=none to p=quarantine, then p=reject. See our DMARC guide for the full walkthrough.

Server version disclosed

Response headers that reveal exact software versions help attackers pick matching exploits. In IIS, remove the X-Powered-By header under HTTP Response Headers, set enableVersionHeader="false" in web.config, and strip the Server header (URL Rewrite, or removeServerHeader="true" on IIS 10+).

Remote Desktop (RDP) exposed to the internet

Internet-facing RDP is one of the most common ways ransomware gets in. Close port 3389 at the perimeter firewall, or restrict it to known static IP addresses. Better, put remote access behind a VPN or an RD Gateway that requires MFA. Then review Windows Security logs (Event ID 4625) for failed logins from outside.

Directory listing enabled

If a folder shows a browsable file list, sensitive documents can leak. In IIS Manager, select the site, open Directory Browsing, and choose Disable. Review the folder's contents while you're there.

Expiring TLS certificate

When a certificate lapses, browsers block your site with a warning. Renew it with your provider and bind it in IIS (Site Bindings). To avoid future scares, automate renewal, for example with win-acme for Let's Encrypt on IIS.

---