A flat network means one compromised machine endangers everything. Segmentation divides the network into zones.
Typical zones¶
- DMZ — public-facing services
- Application tier
- Database tier (strictest rules)
- Management — jump servers
- User network
Cloud VPC¶
resource “aws_subnet” “public” { cidr_block = “10.0.1.0/24” } resource “aws_subnet” “app” { cidr_block = “10.0.2.0/24” } resource “aws_subnet” “db” { cidr_block = “10.0.3.0/24” } resource “aws_security_group” “db” { ingress { from_port = 5432 to_port = 5432 protocol = “tcp” cidr_blocks = [“10.0.2.0/24”] # App subnet only } }
Key Takeaway¶
Segment into zones, control traffic between them. In the cloud: VPC + Security Groups.
securitynetworksegmentation