Lesson 4 of 8 · 10 min read
Segmentation and Egress Control
Network controls matter most after initial compromise. Segmentation divides the network into zones with explicit, default-deny flows between them, from coarse zones (users, servers, management, sensitive data) to per-workload microsegmentation keyed on workload identity. Egress control limits outbound connections to what each system needs, breaking command-and-control, tool downloads, exfiltration and SSRF. Both are designed from observed flows, rolled out in monitor mode, kept as code with owners, and turned into detection by alerting on denied traffic.
free sign-in, no card required
Practise it as an interviewer asks it
Walk through a TLS 1.3 handshake. What does each step protect against?What is SSRF, and why do LLM tools that fetch URLs bring it back?Stateless versus stateful firewalls, NAT, and egress filtering: what does each actually protect?Why does network segmentation matter, and how would you segment an environment, from VLANs to microsegmentation?How would you control egress and detect exfiltration from a training cluster?What are reverse shells and command-and-control channels, why do attackers use them, and how do you detect them?