Network segmentation

Separate public, application and data tiers into subnets with strict rules between them. A compromised web server should not be able to reach the database directly.

Where it shows up in real systems

  • Private network

    Only load balancers belong in public subnets; databases and app servers stay private. Security groups then allow only the traffic each tier needs.

    In production: AWS VPC, Azure Virtual Network, Google VPC

  • Secure admin access

    Instead of opening SSH or database ports to the internet, engineers go through a bastion or an identity-aware proxy with short-lived credentials and session recording.

    In production: AWS Systems Manager Session Manager, Teleport, Google IAP, Azure Bastion, Tailscale

  • Private endpoint

    Traffic to storage, queues or partner APIs stays on the provider backbone instead of crossing the internet through a NAT gateway: safer, and often much cheaper per gigabyte.

    In production: AWS PrivateLink, Azure Private Link, Google Private Service Connect, VPC gateway endpoints

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.

Open the learning path Open the sandbox