Resource Isolation Design Patterns

This chapter explains how a user can use network isolation to protect valuable infrastructure resources. It looks at designing networks, creating “safe‐space” sandbox environments, and building virtual walls to more closely control who gets access to specific resources. Firewalls and other network configuration tools can be used to segment his/her resources, reducing risk exposure for vulnerable devices. Multitiered network designs can provide significant protection. Such designs include demilitarized zones, bastion hosts, and networks divided by purpose (development/staging/production). For local infrastructure, isolated development environments are built using traditional physical or virtual networking. Cloud providers offer simpler—and often much cheaper—alternatives for isolation using, as in the case of AWS, distinct virtual private clouds or even organizational accounts for each environment he/she needs. The chapter also describes how OS operation can gain additional security through the use of mandatory access controls.