Security /
Infrastructure + Network
Follow the traffic
- The path: user → DNS → edge → proxy/load balancer → app → data.
- Controls are much easier to reason about once you know where traffic actually goes.
Ingress / egress
- What can reach this service?
- What can this service reach on the way out?
- Both directions matter.
Segmentation
- The goal is to limit how far one compromise can travel.
- A boundary only counts if it's actually enforced, not just what the network diagram says it should be.
DNS / TLS
- DNS gets traffic to the right place. TLS protects the connection.
- Neither one decides whether the caller should be allowed to do the thing they are asking to do.
- Useful tools: SSL Labs, Security Headers.