Internet-facing device identification

A method of identifying Internet facing computing devices in an organization, the method comprising:

• detecting, by a monitoring agent running on a computing device, a connection on the computing device with a second computing device, the connection designating a source IP address;
• determining, by the monitoring agent, that the source IP address is not associated with the computing device;
• classifying, by the monitoring agent, the source IP address as a public IP address;
• in response to the classifying, generating, by the monitoring agent, a connection-event notice comprising identification information for the computing device and connection information that includes the source IP address;
• and
• communicating the connection-event notice over a network to an Internet facing device management service that identifies the computing device as Internet facing using the connection-event notice.

A system comprising:

• one or more hardware processors;
• and
• one or more computer-readable media having executable instructions for a monitoring agent embodied thereon, which, when executed by the one or more processors, cause the one or more hardware processors to execute actions comprising:
• communicating, over a network by the monitoring agent running on a computing device, an IP address associated with the computing device to an Internet-facing device management service configured to add the IP address to a store of organization IP addresses;
• detecting, by the monitoring agent, a connection on the computing device with a second computing device, the connection designating a source IP address that is not associated with the computing device;
• generating, by the monitoring agent, a connection-event notice comprising identification information for the computing device and connection information comprising the source IP address;
• and
• communicating the connection-event notice over the network to the Internet-facing device management service that identifies the computing device as Internet facing by determining the source IP address is not in the store of organization IP addresses.