What is an SMB vulnerability?

Learn more about SMB, it's risks, and how to help your client properly secure their infrastructure.

Server Message Block (SMB) is a Microsoft network file sharing protocol. If this protocol is identified as unsecured on a policyholder's IT system, this triggers an alert from Corvus. Click here to learn about dynamic security alerts.  

SMB Overview

Leaving an SMB service open to the public can give attackers the ability to access data on your clients’ internal network, and increases their risk of a ransomware attack or other exploit. Notably, SMB1 (a legacy version of the service) was used as an attack channel for both the WannaCry and NotPetya mass ransomware attacks in 2017. Server Message Block (SMB) allows devices on the same network to share files with each other. Printers, mail servers, and high-priority internal network segments use SMB to provide access to remote users.

Best Practices for Securing SMB

Properly securing SMB services is the ideal resolution. We recommend that your clients take the following steps to address their SMB vulnerability.  

1. Work with their IT team to investigate the vulnerability 
2. Assess the version of SMB used. Best practices recommend:
   • Disabling SMBv1 and
   • Blocking all versions of SMB at the network boundary (more information on this here)
3. Let Corvus know that the vulnerability has been resolved or mitigated by emailing services@corvusinsurance.com. We're also here to answer questions about how to resolve an issue.