Defence: segmentation, DMZs and zero trust
One infected laptop should not be able to reach everything. Watch its packet to the database get dropped at the firewall, then see why: the office is split into zones with rules between them, public servers sit in a DMZ, and zero trust checks every request instead of trusting whoever is inside.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01The infected laptop (staff zone) sends a packet to the database on port 5432. Why does the firewall drop it?
The firewall checks its rules top to bottom. Only staff → staff app on port 443 is allowed into the servers zone, so this packet falls through to the default deny.
02Why must a packet from the staff zone to the servers zone pass the firewall at all?
A device sends anything off its own subnet to its default gateway. Making the firewall every zone's gateway puts it on every path between zones.
03What belongs in a DMZ?
The DMZ holds public-facing servers between the internet and the inside. They are the most attacked, so the rules stop them starting connections inward.
04The infected laptop asks the staff app on port 443 and the firewall allows it. Why?
Segmentation trusts network location. An infected device inside a trusted zone gets the same access as a healthy one. That gap is what zero trust closes.
05Under zero trust, which of these is NOT a reason to allow a request?
NIST SP 800-207: no implicit trust is granted because of network location. Each request is checked on identity, device health and policy.
Glossary
- Segmentation
- Splitting one network into zones so a problem in one zone cannot spread freely to the others.
- Zone
- A group of devices with the same job and the same rules, here one VLAN and one subnet each.
- VLAN
- Virtual LAN: one switch split into separate LANs; a frame never crosses from one VLAN to another without being routed.
- Firewall rule
- One line saying which traffic may cross, by source, destination and port. The first matching rule wins.
- Default deny
- Anything no rule allows is dropped.
- DMZ
- Demilitarised zone: a zone for public-facing servers, between the internet and the internal network.
- Zero trust
- A security model with no trust from network location: every request is authenticated and authorised (NIST SP 800-207).
- Malware
- Software that works for an attacker, for example to spread to other computers or steal data.
Notes and sources
- Addresses are examples: 192.168.x.0/24 are private ranges (RFC 1918); 192.0.2.7 and 203.0.113.10 are documentation addresses (RFC 5737).
- The firewall is stateful: once a connection is allowed, its replies are let back automatically, so the rules only list who may start a connection.
- The website’s public address 203.0.113.10 belongs to the firewall, which forwards HTTPS on it to the web server in the DMZ (port forwarding, a form of NAT).
- Zero trust does not throw segmentation away: NIST SP 800-207 lists micro-segmentation as one way to build it. The access check is a policy enforcement point; a policy decision point behind it makes the decision.
- A device health check usually comes from device management or endpoint security software that reports whether the device is up to date and free of known malware.
Quiz Unlocks after the last step.