Network Perimeter Security Health Check

The Network Perimeter Security Health Check audits the defensibility of an organization's external Internet edge. It evaluates how effectively boundary routers, next-generation firewalls, demilitarized zones (DMZs), and edge VPN gateways shield internal systems from Internet-wide scanning and exploitation.

The health check diagnoses common perimeter flaws including unhardened SSH/RDP ports listening on public IP addresses, missing DDoS mitigation layers, unencrypted legacy web protocols, and weak egress filtering that permits covert reverse-shell connections.

A Demilitarized Zone (DMZ) is a perimeter subnet that buffers an organization's private local network from the public Internet. Public-facing systems—such as web servers, mail gateways, and DNS resolvers—must reside in the DMZ so that if an external attacker compromises a web application via SQL injection or zero-day remote code execution, they remain trapped within the perimeter buffer rather than gaining immediate access to internal domain controllers.

The foundational security rule of DMZ architecture is the "One-Way Initiation Principle": systems in the trusted internal LAN may initiate connections into the DMZ (e.g., to manage web servers), but systems in the DMZ must NEVER be permitted to initiate connections into the trusted internal network. If a DMZ web server requires database access, the internal database must either pull data from the DMZ or the DMZ firewall rule must be strictly locked to a single internal database IP on a single port with mutual authentication.