The network attack surface

Welcome to Cloud & Network Security — the last pillar of the Security discipline. Before any protocol or identity check runs, one question decides most of your risk: what can reach this service at all?

This track answers it twice: a firewall that denies by default (rules are first-match, so ordering is the policy), and an exposure classifier that tells you whether a service is reachable from this machine only, from a private network, or from the entire internet. Most cloud incidents are not clever exploits — they are a database bound to 0.0.0.0.

This platform makes exactly that call for its own servers: bind loopback, expose over the private tailnet, or publish deliberately via Funnel (ADR-027).

Same thread as every module here: concept → protocol → attack → defence. Nothing touches a socket — you evaluate policies, never probe hosts.