Network Exposure and the Disappearing Perimeter

The old network perimeter was a place: a ring of firewalls between "inside" and "outside." In the cloud that ring is gone, replaced by thousands of small, software-defined rulesets attached to individual resources. The perimeter did not vanish so much as dissolve into everything — and every security group, NSG, and firewall rule is now a fragment of it that a single change can breach.

In AWS you have security groups and network ACLs; in Azure, network security groups; in GCP, VPC firewall rules. Each governs what can reach a resource and what that resource can reach. They are powerful and granular, which is the point — and also the risk, because granularity means there are thousands of places to be wrong, and the most common way to be wrong is the same everywhere: opening something to the entire internet.

The classic exposures

• Management ports open to the world. SSH (22) or RDP (3389) on 0.0.0.0/0 is an invitation to constant brute-force and the single most-scanned mistake in the cloud.
• Databases with public IPs. A managed database reachable from the internet, guarded only by a password, is one credential-stuffing run from compromise.
• "Temporary" open rules that never close. The 0.0.0.0/0 added to debug a problem at 2am, still there a year later.
• Over-broad internal rules. Allowing an entire VPC to talk to everything flattens the network, so one compromised host reaches all the others.
• Forgotten public endpoints. A load balancer, a test instance, an old API gateway — still listening, no longer watched.

Egress: the direction nobody watches

Inbound rules get the attention; outbound rules decide the damage. Most teams allow all egress by default, which means a compromised workload can freely reach an attacker's command-and-control server, exfiltrate data to anywhere, and pull down additional tooling. Controlling outbound traffic — allowlisting the destinations a workload legitimately needs — is one of the highest-leverage and most-skipped controls in cloud networking. It will not stop the initial compromise, but it strangles what the attacker can do next.

Rebuilding the perimeter as many small ones

• Default deny, both directions. Open only the specific ports and destinations a workload needs, inbound and outbound.
• Remove public management access entirely. Reach instances through a bastion, SSM Session Manager, or a zero-trust access layer — not an internet-facing SSH port.
• Keep databases and internal services private. No public IPs; reach them through private endpoints and peering.
• Segment to contain. Micro-segment so a compromised workload cannot freely reach the rest of the estate — the cloud analogue of internal firewalls.
• Continuously detect drift. Alert the instant any rule opens a sensitive port to 0.0.0.0/0, and auto-revert where you safely can.

The disappearing perimeter is really a distributed one: thousands of rules that collectively define your exposure, changing constantly as teams ship. No single firewall to audit means no single place to look — which is why network exposure is fundamentally an inventory problem. Every listening endpoint you cannot see is one an attacker's scanner already has, because you can't defend what you haven't discovered.