Below figure shows the logical network map of a small company doing business in the healthcare field. The web server hosts a dynamic web application programmed in one of the modern frontend programming languages. The web application is behind the firewall and accessible from the Internet $($Port $443$ is allowed in the firewall$).$ The web application has more than one thousand active users. Web application connects to the database in the DMZ$.$ Database stores sensitive PII and PHI data. A third$-$party independent penetration testing service has not tested the web application; therefore, an independent eye has not checked yet for OWASP Top $10$ security risks. There is two$-$way communication between DMZ and Local Area Network