Microsegmentation

As explained in Secure APIs

Microsegmentation is the division of a network into finely grained isolated zones with distinct access controls.

Microsegmentation divides a network into finely grained, isolated zones with distinct access controls. It limits lateral movement by placing more sensitive services behind stronger controls and monitoring. section 9.2

Protecting medical records

Separate appointment management from medical-records services. If attackers compromise the appointment API, isolation prevents them from reaching medical-records data. The sensitive service can receive stricter access controls and enhanced compliance monitoring. section 9.2

Figure 9.12 Using a combination of API gateway and bastion server, we make sure that our APIs expose only well-documented, tested, secure endpoints to the internet while keeping internal endpoints or endpoints in development accessible only by internal users and developers.

Use an API gateway and bastion server to expose only tested, secure endpoints publicly while restricting internal or developing endpoints to authorized users. section 9.2

How Secure APIs covers it

How deep it goes

Explains service isolation, stricter controls, monitoring, and attack consequences without detailing implementation configuration.

Examples

Uses appointment-management and medical-records services to demonstrate isolation and compromise containment.

What you can do after

Operate/configure isolated service networks that reduce lateral movement and apply stronger controls to sensitive APIs.

How it connects

Connects microsegmentation with network segmentation, lateral movement, API gateways, bastion servers, DMZs, and private subnets.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

• network segmentationkind of · Network segmentation is the division of a network into distinct physical or logical zones with controlled communication between them.
• lateral movementaddresses · Lateral movement is an attacker's progression from a compromised system, account, or resource to additional systems, accounts, or resources within an environment.
• zero-trust networkingimplements · Zero-trust networking is a security architecture that grants no implicit trust based on network location or prior access and verifies and authorizes access requests explicitly.
• software-defined networkimplemented by · A software-defined network is a network architecture that separates control from forwarding and manages connectivity, configuration, and forwarding behavior programmatically.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.