Network Topologies and Segmentation

• Design a tiered topology with DMZ, trusted and management zones
• Explain how segmentation reduces blast radius
• Trace a user's request through the zones to name where controls sit

• Flat networks fail fast: one exploited workstation can reach the database fleet wholesale.
• The DMZ pattern lets you expose services without exposing trust.
• Segmentation zoes are where detection value lives: cross-zone traffic should be rare, so any of it is interesting.
• Compliance (PCI, SOC 2) increasingly requires evidenced segmentation.

The porch (DMZ) faces the street and holds the mail slot; the foyer lets guests in but not upstairs; the office and kids' rooms are zones with rules about who may cross. A burglar in the porch doesn't get the bedroom jewelry.

• Zones are defined by policy (what runs there) and by ACLs/firewalls (what may cross in/out).
• The DMZ holds servers that must be reachable from the internet; the firewall lets web traffic in but the DMZ cannot initiate back into trusted.
• Trusted zones terminate the user workforce; management zones host admin paths and bastions, reachable only from admin subnets.
• Segmentation is applied with firewalls, VLANs (layer 2 isolation), subnets (layer 3) and, increasingly, identity-aware policy (zero trust).
• Every cross-zone flow should be permitted by exception and observable.

• A web stack lives in the DMZ; the database cluster lives in a dedicated DB zone the DMZ can reach only on 5432.
• Workstations cannot initiate to the management zone at all — admins come in via a bastion with MFA.
• A SIEM alert fires on 'DMZ → trusted zone' flows because they should only occur as documented exceptions.

• Default-deny between zones; document every exception rule with an owner and expiry.
• Keep the DMZ minimal and patched — it's the most exposed real estate.
• Route management traffic on a dedicated plane and isolate it from user/data traffic.
• Test segmentation continuously: probe each boundary from authorized lab hosts so theoretical isolation is proven isolation.

• Designing zones but deploying a flat network 'for now' — 'for now' becomes the breach.
• Putting the database in the DMZ to 'simplify' the firewall.
• Forgetting management-plane isolation, so RDP to the domain controller rides the user VLAN.
• Segmentation without monitoring: if no one watches the boundaries, a wider open door may never be noticed.

• When a zone 'shouldn't reach' another but does, check for extra routes, trunk misconfig and duplicate subnets.
• Trace with traceroute across each boundary; a control that isn't the named firewall is a red flag.
• Query the firewall's session table for flows between zones and review exceptions.

• Segmentation is only as strong as the boundary device's own hardening — a public web server with admin interfaces exposed is a DMZ in name only.
• Zero-trust architecture builds on segmentation by adding per-workload, identity-based micro-segmentation where flattening is unavoidable.