Data Centre Security Learning Workspace
Explore how data centre security works in practice. Map trust boundaries, control east–west and north–south traffic, investigate suspicious activity, apply Zero Trust principles, and practise containing and recovering from security incidents through interactive network scenarios.
Learning Control Bar
Navigate the five stages and track your progress.
Your learning pathway
Explore the Security Workspace
Follow five connected stages, from understanding security boundaries to investigating threats and validating incident recovery. Select a stage to jump directly to its introduction and interactive exercises.
Stage 1 - Understanding the Architecture
Understand Security Architecture
Before investigating a threat or writing a security rule, understand what you are protecting, where trust begins and ends, and how systems are separated. A data centre security design is more than a collection of firewalls: it is a set of boundaries, controls and access decisions that work together to limit exposure and contain compromise.
What you will explore
Start by mapping the environment and identifying the purpose of each security zone. Consider how management systems, application workloads, shared services and external connections should interact—and which paths should remain restricted.
- Security zones: group systems according to their role, sensitivity and exposure.
- Trust boundaries: identify where access must be evaluated rather than automatically trusted.
- Control placement: understand where firewalls, segmentation controls and management safeguards can enforce policy.
- Blast-radius reduction: design boundaries that limit how far a compromised system can reach.
Practical focus: establish the security context first, then use the interactive exercises below to investigate architecture and trust decisions. Examples in this workspace are educational simulations.
Stage 1 · Interactive Architecture Lab
Security Architecture Explorer
Select a zone to inspect its purpose and trust boundaries. Then test illustrative communication paths to see how architectural policy can allow or restrict access between systems.
Application-to-data access may be permitted for an explicitly authorised service flow. The real decision depends on the configured policy.
Trust Zones and Security Boundaries
A network is not one uniform trust domain. Select a boundary to inspect what separates the zones, what should cross it, and which controls help prevent an attacker or misconfigured workload from moving freely.
On a small screen, scroll horizontally across the diagram to view all zones.
B1 · External to Application
Controls traffic entering application-facing services from less-trusted networks.
Reduce exposure at the entry point
Without a defined policy, externally reachable systems may expose unintended services or provide a route deeper into the environment.
Test a cross-zone connection
Choose a source and destination, then evaluate the illustrative security policy.
External-to-application traffic may be allowed for published services only. The actual decision depends on the configured rule, service, port, identity and inspection requirements.
Security Control Mapping
Security architecture becomes meaningful when each objective is backed by an appropriate control. Select an objective to explore the controls, where they operate and what to verify during a design review.
Segment workloads
Restrict east–west communication so that each workload can reach only the services required for its role.
Distributed or network firewalls
Apply explicit rules between application tiers, shared services and protected data zones.
Network ACLs and microsegmentation
Reduce permitted communication between subnets, workloads or application components.
Workload identity and service policy
Where supported, make authorization depend on workload identity and service purpose as well as network location.
Flow logging and policy review
Record relevant permitted and denied connections, identify exceptions and review rules for unnecessary access.
3 · Design review checklist
Mark the checks you have completed for the selected objective.
Add Your Heading Text Here
Traffic and Access Control
Security zones define where trust changes. Access-control policies determine what can cross those boundaries. In this stage, explore traffic direction, permitted service flows, enforcement points and the difference between network reachability and genuine authorization.
A route between two systems does not mean the connection should be allowed. Each flow needs a valid purpose, a defined policy and suitable enforcement and monitoring.
What you will investigate
Traffic direction
Distinguish north–south traffic entering or leaving the data centre from east–west traffic moving between internal workloads and services.
Policy decisions
Decide which source, destination, protocol, port and identity combinations should be permitted, restricted or denied.
Enforcement points
Understand the roles of firewalls, network ACLs, workload controls and identity-aware policies in enforcing access decisions.