How deeply does Secure APIs cover demilitarized zone?

Defines the segment, identifies its gateway components, and connects it to subnet isolation and controlled cross-segment communication.

Demilitarized zone

As explained in Secure APIs

A demilitarized zone is a hardened network segment exposed to untrusted external traffic and positioned between the internet and an internal network.

A demilitarized zone (DMZ), or perimeter network, is an internet-exposed network segment that buffers untrusted traffic from internal systems. It contains hardened components rather than application services themselves. section 9.2

Use a DMZ to reduce exposure and control inbound API traffic:

Channel inbound traffic through an API gateway, reverse proxy, load balancer, or similar internet-facing technology in the DMZ. section 9.2
Keep services in private subnets without direct internet access, allowing communication across segments only through controlled network bridges and access rules. section 9.2 section 9.5

API infrastructure layout

Place an API gateway and bastion server in the DMZ, route approved inbound requests toward private APIs, and restrict the bastion server to traffic from permitted origins. Keep internal databases and development endpoints out of the internet-facing segment.

How Secure APIs covers it

liveBook manning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityA demilitarized zone is an isolated network segment for systems that must be reachable from untrusted networks while limiting exposure of internal hosts.

Compare how 2 books explain demilitarized zone →

Related concepts

segmentkind of · A segment is a distinct portion or bounded region of a larger structure, system, or sequence, with boundaries or properties determined by its context.
operational technologyconfigures · Operational technology comprises hardware and software systems that monitor or control physical processes, equipment, and industrial operations.
security zonekind of · A security zone is a logical network segment governed by distinct security rules and access requirements.
firewalluses · A firewall is a network security system that monitors and filters communications according to rules governing which traffic is permitted or blocked.
serverhas part · A server is a computer system or software process that receives requests from clients or other systems and provides resources, data, or services in response.
network segmentationimplements · Network segmentation is the division of a network into distinct physical or logical zones with controlled communication between them.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.