Learn · How-to, Fixes · 7 min read

How to fix common security issues Torva finds

These are the findings Torva turns up most often on small-business networks, and how to fix each one. Most take minutes and cost nothing. Windows and IIS steps are included, since that's what many small offices run.

Outdated TLS versions (TLS 1.0 / 1.1)

These old encryption protocols are deprecated and fail PCI and modern browsers. On Windows/IIS, the simplest fix is the free IIS Crypto tool: apply the "Best Practices" template and reboot. That disables TLS 1.0 and 1.1 and enables strong ciphers. Then rescan to confirm only TLS 1.2 and 1.3 remain.

Missing HSTS header

Without HTTP Strict Transport Security, a visitor can be downgraded to insecure HTTP on a hostile network. In IIS Manager, open HTTP Response Headers for the site and add:

Name:  Strict-Transport-Security
Value: max-age=31536000; includeSubDomains

Only add includeSubDomains once you're sure every subdomain supports HTTPS.

No DMARC record

Without DMARC, criminals can send email that looks like it came from your domain. Start in monitoring mode by adding a TXT record and reviewing the reports for a few weeks before tightening the policy:

Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@example.com

Once legitimate mail passes, move the policy from p=none to p=quarantine, then p=reject. See our DMARC guide for the full walkthrough.

Server version disclosed

Response headers that reveal exact software versions help attackers pick matching exploits. In IIS, remove the X-Powered-By header under HTTP Response Headers, set enableVersionHeader="false" in web.config, and strip the Server header (URL Rewrite, or removeServerHeader="true" on IIS 10+).

Outdated software with known vulnerabilities

The service reports a version that has published vulnerabilities (CVEs). Confirm the version on the system itself, then update to the fixed version named in the finding, or the vendor’s current supported release. Fix anything marked actively exploited first. If the system can’t be updated soon, restrict who can reach the service and record the decision and a review date.

Verify patch level (Linux distribution builds)

Ubuntu, Debian, Red Hat and other distributions fix security flaws without changing the version number a service reports, so a patched server can still show an old version. Install current security updates (for example sudo apt update && sudo apt upgrade or sudo dnf upgrade), then check each listed CVE in the distribution’s security tracker for your installed package. If the operating system release is end of life, upgrade it; it no longer gets those fixes.

Remote Desktop (RDP) exposed to the internet

Internet-facing RDP is one of the most common ways ransomware gets in. Close port 3389 at the perimeter firewall, or restrict it to known static IP addresses. Better, put remote access behind a VPN or an RD Gateway that requires MFA. Then review Windows Security logs (Event ID 4625) for failed logins from outside.

Directory listing enabled

If a folder shows a browsable file list, sensitive documents can leak. In IIS Manager, select the site, open Directory Browsing, and choose Disable. Review the folder's contents while you're there.

Expiring TLS certificate

When a certificate lapses, browsers block your site with a warning. Renew it with your provider and bind it in IIS (Site Bindings). To avoid future scares, automate renewal, for example with win-acme for Let's Encrypt on IIS.

---