# 19 Network security policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | Infrastructure Owner |
| Review | Yearly |
| Applies to | Every network path into, out of, and between in-scope systems |

## Boundary

1. **Default deny inbound** on every production host and security group. The only inbound traffic allowed is from the edge (Cloudflare) to the application ports, and administrative access through the approved path (OPS-05, ACC-08).
2. **No direct internet exposure** of databases, caches, queues, admin consoles, metrics endpoints, mail relays, or development servers. Services bind to loopback or the private network unless they are meant to be public.
3. **Public hostnames are published only through the edge.** Each one is in the asset inventory with an owner, has TLS, security headers, and a reason to exist.
4. **Egress** from production is limited to what the services need where the platform allows it, and server-side fetches of user-supplied URLs have SSRF guards (playbook security defaults).
5. **Segmentation:** production, staging and development are in separate networks or accounts. Production does not share a host or a network with personal projects, game servers, or experiments.

## Edge

- Cloudflare in front of every public in-scope hostname: TLS 1.2 minimum, HSTS, WAF managed rules on, rate limiting on authentication and public forms, DDoS protection on.
- Changes to DNS, tunnel ingress and edge rules go through the change process (CHG-07). The Cloudflare account has MFA enforced and named members only.

## Administrative access

- SSH, where used, accepts keys or short-lived certificates only, no passwords, no root login, from the approved path only, with each login logged centrally.
- Remote desktop and screen-sharing tools are not installed on production hosts.

## Verification

- An external port scan of every in-scope public address runs quarterly and after network changes. Any open port that is not in the allowed list is closed or added to the list with an owner and a reason (ACC-08).
- The host baseline check runs quarterly and records firewall state, listening services, SSH configuration, audit logging, and disk encryption (OPS-05).