new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

network segmentation/architecture

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Network segmentation three-layer architecture components

Developed information systems should consist of at least three security zones: FRONTEND, MIDDLEWARE, and BACKEND.

FRONTEND security zone network elements

The FRONTEND security zone is a set of segments containing: balancer, application layer firewall, web server, and web cache.

MIDDLEWARE security zone network elements

The MIDDLEWARE security zone is a set of segments containing: web applications that implement information system logic, authorization services, analytics services, message queues, and stream processing platform.

BACKEND security zone network elements

The BACKEND security zone is a set of network segments containing: SQL database, LDAP directory (Domain controller), storage of cryptographic keys, and file server.

Firewall crossing in network diagrams

In network segmentation diagrams, crossing the border of a rectangle indicates crossing a firewall.

DMZ Inbound segment purpose

DMZ Inbound is a FRONTEND segment for hosting services and applications accessible from the Internet; these services must be protected by WAF (Web Application Firewall).

DMZ Outgoing segment purpose

DMZ Outgoing is a FRONTEND segment for hosting services that are inaccessible from the Internet but have access to external networks; the firewall contains no rules allowing traffic from external networks.

Load balancer access control alternative

When hosting multiple applications on the same network with fewer network segments, a load balancer can be placed on the network to perform access control at the OSI layer 7 using HTTP request parameters, requiring only one open port to the network.

Give your agent this brain