Myth-Busting SOP: 'It's Internal-Only, No Hardening Needed'

Myth-Busting SOP: 'It's Internal-Only, No Hardening Needed'

Staging, dashboards, and 'internal' tools get indexed, leaked in referrers, and reached through one phished VPN credential. The perimeter is not a wall. Treat internal as hostile:

— Step 1: Put HTTP auth or SSO in front of every non-public environment.
— Step 2: Add noindex headers AND robots rules, then block search bots at the firewall — assume robots.txt is ignored.
— Step 3: Use real TLS internally; self-signed certs train users to click through warnings.
— Step 4: Disable default creds and sample data on staging immediately.
— Step 5: Verify externally: curl the staging hostname from off-network — it should refuse, not render.

Internal is a label, not a boundary. Run this every time.