97 Things Every Information Security Professional Should Know

Chapter 47. Using Isolation Zones to Increase Cloud Security

Lee Atchison

In cloud-based infrastructure architectures, as it is in on-premise infrastructure architectures, it’s generally considered best practice for security purposes to split your infrastructure into zones. These zones provide levels of security isolation that keep your application data and core capabilities safer from outside attacks.

General Isolation Zone Architecture

A good best practice for zone isolation is to split your backend infrastructure into three distinct isolation zones. Typically, the three zones are:

Public zone

This zone is exposed to and connected to the internet. IP addresses in this zone are generally publicly accessible from the internet. Servers, while generally protected via various security firewalls, receive traffic directly from users out in the internet.

Demilitarized zone (DMZ)

This zone is isolated from the internet and is set up so that only specific servers—those in the public zone—have the ability to send traffic to them. End users, out in the internet wild, have no access to these servers.

Internal zone

This zone is further isolated from the internet. No publicly facing servers, even application servers such as those running “frontend services,” have the ability to send traffic to this zone. Only servers isolated in the DMZ, and servers within the application backend, have the ...