Network topology is the structure of a network: how networks, hosts, services, and communication components connect. In API security, that structure determines which resources are reachable, which traffic is permitted, and how an attacker might move through the environment. section 9.2 section 9.0
A safer design partitions infrastructure into segments or subnets with different access levels. Public subnets can reach the internet; private subnets cannot. Services in one segment communicate directly, while communication across segments requires an intentional network bridge. section 9.2
Apply the topology as a set of access boundaries:
- Place the internet-facing boundary in a demilitarized zone (DMZ), and channel inbound traffic through an API gateway, reverse proxy, or load balancer rather than deploying services directly there. section 9.2
- Keep databases, queues, internal endpoints, and other services in private subnets unless external access is required. section 9.0
- Use a hardened bastion server in the DMZ to reach internal APIs and databases, allowing traffic only from trusted origins. section 1.2.3
- Disable unnecessary traffic between services and use restrictive firewalls to limit lateral movement and access to sensitive resources. section 9.0 section 1.2.3
A controlled API boundary
Expose only documented, tested, secure endpoints through an API gateway in the DMZ. Keep internal and development endpoints accessible only to internal users and developers, using a bastion server for controlled access to private APIs and databases.
