Security › Module 5 › Lesson 1
Perimeter Evolution
DMZ and segmentation literacy names perimeter zones, east-west controls, firewall rule intent, and VLAN isolation — draft segmentation row on YOUR $ARCH_LAB fictional org LAB-ARCH-001.
Visual · t41_dmz_segmentation
DMZ segmentation literacy. $ARCH_LAB only. Original Cyberlium.
Opening
Flat networks amplify lateral movement — literacy teaches DMZ and segmentation vocabulary so fictional org diagrams on $ARCH_LAB show defensible zone design.
A DMZ hosts internet-facing services separated from internal tiers by firewall rules — web servers in DMZ, app servers internal, database in restricted segment. Segmentation limits blast radius when one zone is compromised. On Cyberlium you design fictional LAB-ARCH-001 zones under $ARCH_LAB — never copy employer production firewall exports or live target network maps. Cyberlium writes segmentation row on YOUR $ARCH_LAB — zone name, purpose, allowed flows, example rule intent for one fictional LAB-ARCH-001 tier. Next: Microservices Security.
1. DMZ and segmentation components (named)
DMZ: internet-facing web and reverse proxy on YOUR fictional org — limited inbound, controlled outbound. Internal tier: application servers with no direct internet route. Data tier: database segment with app-only access. East-west: micro-segmentation between internal workloads on LAB-ARCH-001.
On $ARCH_LAB, write segmentation row — zone, purpose, allowed flow summary, rule intent example.
Command guide
Try these commands — DMZ and segmentation components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP Threat Modeling — https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html Microsoft SDL — https://www.microsoft.com/en-us/securityengineering/sdl/ NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
curl -sS https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html | head -10
cat > "$ARCH_LAB/notes/dfd-named.txt" <<'EOF'
Data Flow Diagram (DFD) — NAMED LITERACY:
External entity: actor outside system (customer, partner, admin)
Process: transforms data (API service, batch job)
Data store: persistent storage (DB, object store, cache)
Data flow: labeled arrow — protocol + data classification (fictional labels)
Trust boundary: dashed line where control requirements change
Lab: security-design/dfd-*.md — markdown/mermaid-style text for LAB-ARCH-001
EOFCommand — copy this
grep -E 'External entity|Trust boundary|dfd' "$ARCH_LAB/notes/dfd-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: OWASP Threat Modeling (https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why segmentation supports defense in depth
Perimeter breach should not mean instant database access — zones force additional crossings. Documented rule intent survives firewall review and architecture audit on lab templates. Segmentation complements zero trust — zones plus identity verification.
Students draft lab segmentation on notes — production segmentation follows change control and network architecture standards.
3. Lab boundary
Forbidden: using segmentation notes to blueprint attack paths against real firewalls. Allowed: DMZ segmentation card — zone design with $ARCH_LAB fictional systems.
Ship: segmentation row for YOUR lab zones. Next: Microservices Security.
4. What you ship: DMZ segmentation row for $ARCH_LAB
Zone, purpose, allowed flows, rule intent. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. Segmentation row. $ARCH_LAB named. File t41-m05-l01-dmz-segmentation.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Design flat LAB-ARCH-001 network because 'firewall is enough.' Import employer firewall export into lab.
Right
Write DMZ segmentation row for YOUR $ARCH_LAB fictional zones. Next: Microservices Security.
Mission: draft segmentation on YOUR lab org
1) Name DMZ, internal, and data zones. 2) Write allowed flow between two zones. 3) Document one rule intent example. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Rule intent beats copying rule IDs — reviewers ask why the flow is allowed.
Knowledge Check
APPLY: DMZ on Cyberlium primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Segmentation limits blast radius when one zone is compromised.
True or False
Knowledge Check
APPLY: DMZ segmentation literacy on Cyberlium uses:
Multiple choice