Labs

14 reusable planning exercises for network segmentation and service placement. Each focuses on the procedure, verification, stop conditions, and evidence that should exist before a change is accepted.

Network design

Plan segmentation as a sequence of independently testable changes, beginning with the lowest-risk case.

  1. Document the physical topology

    A verified port map and independent recovery path turn a risky network change into a reviewable one.

  2. Prepare without moving traffic

    Separating preparation from cutover reduces the number of variables that can fail at once.

  3. Prove a low-risk test zone first

    Tagging, policy, and negative tests should be proven on disposable systems before a real cutover.

  4. Separate user and untrusted clients

    Client groups with different trust requirements should not share an unrestricted broadcast domain.

  5. Create a narrow administration path

    Management restrictions are safe only after an independent administrative path has been tested.

  6. Move services after lower-risk zones

    Public and shared services should move only after the same mechanism has succeeded on less visible systems.

  7. Move management traffic last

    Changing the network used for recovery should be the final cutover, not the first experiment.

Service design

Define each service boundary and prove both intended access and intended denial.

  1. Firewall and router policy

    Segmentation matters only when routing ownership and the allow-and-deny policy are explicit and tested.

  2. Bastion host design

    A controlled entry point needs a narrow role, auditable access, and a documented failure boundary.

  3. Choose one primary remote-access path

    Overlapping remote-access systems create duplicate policy surfaces and make effective reachability harder to audit.

  4. Container host boundaries

    Workload inventory, persistence, and network policy should be known before a container host crosses trust zones.

  5. Keep a media service local by default

    A service should not become internet-reachable merely because a convenient publishing path already exists.

  6. Isolated test machines

    Disposable systems are useful only when their isolation and negative firewall rules are verified.

  7. Platform-specific study machine

    Distribution-specific claims should be tested on the platform they describe rather than inferred from another system.