Our security auditor is an idiot. How do I give him the info he wants? (2011)
Personal ancecdote:
Our backend was exposed using a cloudflare tunnel (we call cloudflare, they expose it with security scanning, etc.)<p>Auditor wants to see firewall rules on our IP addresses, except we don't have IP addresses, we were small enough that the default Azure general shared outbound network worked. (Think CGNAT). No amount of explaining this would check the box.<p>Solution: add a public IP to our prod env, unassigned to anything, with firewall rules. Audit passed.