Exercise 3: The Flaw in "Safe Because It's Only on a Private IP" — Possible Solution
====================================================================

The flaw:

Per the chapter's own warn-box, "it's easy to assume private IP
ranges are inherently safer simply because they can't be reached
directly from the internet without NAT or port forwarding. That's
true as far as it goes, but it isn't a security control by design --
an attacker already on the local network, or malware already running
on a device behind the router, has full, direct access regardless of
the address being private." The colleague's reasoning treats "not
reachable directly from the internet" as equivalent to "safe from
attackers," but those are two genuinely different claims.

Being on a private 10.x.x.x address does mean the database server
can't be reached by an arbitrary attacker sitting out on the open
internet without some additional mechanism (NAT translation, port
forwarding, or a VPN) bridging the gap -- that part of the reasoning is
correct. But it says nothing at all about an attacker or malicious
process that is ALREADY somewhere inside that same private network.
Per the chapter, an attacker already on the local network -- whether
through a compromised employee laptop, a rogue device plugged into the
office network, or malware that got onto any machine inside that
network through a completely unrelated route (a phishing email, an
infected download, a vulnerable web application on another internal
server) -- can reach the database server's private IP address exactly
as directly and easily as any other device on that same local network
can. The private addressing scheme creates no barrier at all once an
attacker is already inside the boundary it was never designed to
protect against in the first place.

The chapter's own closing line makes the distinction explicit: "Don't
confuse 'not internet-routable' with 'protected.'" The database
server's private addressing is a side effect of how NAT and private IP
ranges work, not a deliberate access-control mechanism -- treating it
as if it were one leaves the server with no actual defense against
exactly the kind of internal-network compromise that real-world
breaches very often involve.

WHY THIS WORKS AS AN ANSWER
------------------------------
This distinguishes what a private IP address genuinely does provide
(no direct reachability from the open internet) from what the
colleague incorrectly assumes it provides (protection from any
attacker), using the chapter's own warn-box and its specific example
of an attacker or malware already inside the network.