Operational explainer — no hostile actormedium
The management interface on the internet: the most expensive shortcut you can take
Almost every serious advisory contains, at the bottom, the same note: if the management interface is not reachable from the internet, the attack surface is reduced. That sentence is worth more than a lot of expensive technology. CISA turned it into a binding directive for US federal agencies, BOD 23-02, which defines precisely what a management interface is and offers exactly two ways to secure it. An explainer on applying that logic outside the federal perimeter, where it is not mandatory but pays off anyway.
The note at the bottom of the advisory
Read enough security bulletins and you start noticing a recurring sentence, almost always relegated to a footnote: if the management interface does not have public internet access, the attack surface associated with this vulnerability is reduced. Typographically, it is an aside. In practice it is often the measure that matters most of everything listed, because it works before the patch, and it covers today's flaw as well as the one nobody has found yet.
CISA took that note and turned it into a binding directive: Binding Operational Directive 23-02, Mitigating the Risk from Internet-Exposed Management Interfaces, issued on 13 June 2023. It binds US federal civilian agencies, not European companies. But the logic inside it travels anywhere, and it has the rare merit of being written precisely enough to apply without interpretation.
CISA's reasoning
The directive starts from an observation about attacker behaviour. As organisations improved visibility into their networks and their endpoint detection and response, hostile actors moved the target: from endpoints to the network devices supporting the underlying infrastructure. On those, often, there is no agent, the software is old and the configuration dates back years.
- 01Endpoints defend themselves betterEDR, visibility, response
- 02Attackers change targetthe devices holding the network up
- 03Risk multipliesif the console of those devices is reachable from the internet
And CISA adds the point that closes the argument: most device management interfaces are designed to be accessed from dedicated physical interfaces or management networks, not directly from the public internet. They were never meant to be there. When they are, it is almost always for convenience: quick access from home, overnight maintenance, a configuration done in a hurry and never revisited.
What counts as a "management interface"
The definition is useful because it is narrow and checkable: a dedicated device interface, accessible over network protocols, meant exclusively for authorized users to perform administrative activities on a device, a group of devices or the network itself.
The listed protocols cover essentially everything used to administer something remotely: HTTP and HTTPS, FTP, SNMP, Telnet, TFTP, RDP, rlogin, RSH, SSH, SMB, VNC and X11. It is worth noting what the directive explicitly excludes: web applications and interfaces used for managing Cloud Service Provider offerings, including APIs and management portals. Those follow a different logic.
The only two paths
The most useful part of the directive is that it does not offer a menu of options. It offers two, and says which it prefers.
The first is to remove the interface from the internet, making it accessible only from an internal enterprise network. CISA specifically recommends an isolated management network: not merely "behind the firewall", but a segment dedicated to administration, separate from ordinary traffic.
The second — and the directive names it the preferred action — is to mediate the access: deploy capabilities, as part of a Zero Trust Architecture, that enforce access control to the interface through a policy enforcement point separate from the interface itself. The references are OMB M-22-09, NIST SP 800-207, the TIC 3.0 Capability Catalog and CISA's Zero Trust Maturity Model.
The difference between the two runs deeper than it looks. In the first case you take the device out of sight. In the second you leave it reachable, but the thing deciding whether to let you through is no longer the device itself: it is an external component, patched, monitored, enforcing a policy. That is exactly why CISA prefers it: if the flaw is in the interface's own authentication — as with static credentials or bypasses — a separate control point keeps doing its job even while the device is failing.
How to apply it if you are not a federal agency
The directive's 14 days do not bind you. The method does, and it comes down to three steps.
First: know what you have exposed. Not "what you think you have exposed". The directive has CISA scan and notify the agencies; outside that perimeter the work is yours, and it must be done from the outside, from the point of view of someone looking at your network from the internet, not from the internal console showing you the configuration you believe you have.
Second: decide which of the two paths, per device. Many organisations stall looking for one perfect answer for everything. There isn't one: the isolated management network is right for most equipment, the mediated enforcement point for the few things that genuinely must stay reachable.
Third: make it a standing control, not a project. The directive asks not only to remediate what exists today, but to implement technical and management controls so that every existing and newly added device starts life with one of the two protections in place. That is the difference between a clean-up and a habit: the first falls apart with the first device installed in a rush.
It is not a brilliant measure and it will not headline any exciting presentation. But it is the countermeasure that, on the day an advisory lands for a product you own, turns a sleepless night into a patch you can schedule calmly.
