Network
- The BDS host sits on a segmented / firewalled network.Not on an open, flat, or guest network.
- No inbound access to the BDS host from untrusted networks.The internet cannot reach the host's BDS ports.
- Any access beyond
localhostis firewall-restricted to named hosts.If BDS stays single-box, it remains loopback-only and no rule is needed.