Network security policy

Boundary#

1. Default deny inbound on every production host and security group. The only inbound traffic allowed is from the edge (Cloudflare) to the application ports, and administrative access through the approved path OPS-05, ACC-08.
2. No direct internet exposure of databases, caches, queues, admin consoles, metrics endpoints, mail relays, or development servers. Services bind to loopback or the private network unless they are meant to be public.
3. Public hostnames are published only through the edge. Each one is in the asset inventory with an owner, has TLS, security headers, and a reason to exist.
4. Egress from production is limited to what the services need where the platform allows it, and server-side fetches of user-supplied URLs have SSRF guards (playbook security defaults).
5. Segmentation: production, staging and development are in separate networks or accounts. Production does not share a host or a network with personal projects, game servers, or experiments.

Edge#

• Cloudflare in front of every public in-scope hostname: TLS 1.2 minimum, HSTS, WAF managed rules on, rate limiting on authentication and public forms, DDoS protection on.
• Changes to DNS, tunnel ingress and edge rules go through the change process CHG-07. The Cloudflare account has MFA enforced and named members only.

Administrative access#

• SSH, where used, accepts keys or short-lived certificates only, no passwords, no root login, from the approved path only, with each login logged centrally.
• Remote desktop and screen-sharing tools are not installed on production hosts.

Verification#

• An external port scan of every in-scope public address runs quarterly and after network changes. Any open port that is not in the allowed list is closed or added to the list with an owner and a reason ACC-08.
• The host baseline check runs quarterly and records firewall state, listening services, SSH configuration, audit logging, and disk encryption OPS-05.