What is reachable.
THE PRINCIPLE
Allow only what is needed, from where it is needed.
WHAT TO ALLOW
Web traffic, publicly Administrative access, restricted where possible
WHAT TO NEVER EXPOSE
Databases Administrative interfaces Internal services Anything with default credentials
WHY
Anything reachable is found by scanning within hours.
WHAT TO CHECK
What is actually listening, and whether each should be.
HOW
Examine the listening ports, and scan from outside.
WHAT TO DO ABOUT SOMETHING UNEXPECTED
Establish what it is before disabling it.
WHAT TO DOCUMENT
Every rule, and why it exists.
WHY
Undocumented rules accumulate and nobody dares remove them.
WHAT TO REVIEW
The rules, periodically.
WHAT TO AVOID
Opening access broadly to make something work Disabling the firewall temporarily and forgetting
WHAT TO PREFER
A private network for services communicating with each other.
WHAT TO VERIFY AFTER ANY CHANGE
What is reachable from outside.
