Segmentation strategy for a hybrid architecture
Scenario
You've scoped the CDE (Day 10) at SwiftLend. Now you need to design network segmentation so the CDE is isolated from the rest of SwiftLend's ~40 microservices. Currently everything is on a single AWS VPC (10.0.0.0/16) with permissive security groups.
Your role
You are the CDE Segmentation Architect.
Your task
Design the target-state network architecture. Deliver: 1. Subnet plan (CDE + non-CDE) 2. Security group / NACL rules — explicit allow-list only 3. Traffic-flow diagram (Mermaid or ASCII) showing ingress/egress 4. Segmentation validation approach (how you'll PROVE segmentation is effective) 5. 3 monitoring alerts that fire if segmentation is bypassed
Deliverable format: Design document with diagram, ~700-1000 words
Toolkit
- PCI DSS v4.0 Req 1 — Network security controls
- Segmentation validation: penetration test at least annually, plus continuous monitoring
- Common AWS pattern: separate VPC for CDE, use PrivateLink for connectivity, no direct internet gateway from CDE
- Alerts: unauthorised outbound to internet from CDE, unauthorised inbound from non-CDE, new security-group rule
Success criteria (what the AI grades against)
- CDE in separate VPC or account (not just subnet)
- Egress from CDE is explicitly restricted (default-deny)
- Segmentation validation methodology names both automated + human validation (pentest)
- Alerts are specific and actionable
- Diagram shows real traffic flows (customer → LB → app → CDE, not just boxes)
- Bastion / jumpbox access to CDE handled explicitly
Log in to submit your deliverable for AI review.
Log in / Register