Demo: protecting Larkspur's storefront and payment paths
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
apply layered controls to the storefront and isolate payment flows, preparing ARC-018-LAB1.
Draft outline details
Step by step
- List public endpoints: web storefront, mobile API, back-office portal, webhook receiver for the payment provider.
- Edge: CDN with DDoS protection, WAF with managed rules and rate limits on login and checkout; origin restricted to the edge.
- Segment: payment-related components in their own segment with tight flows and egress only to the payment provider.
- Back office: reachable only through SSO and restricted source networks, not open to the internet.
- Planned mistake: the webhook receiver left unprotected "because the provider calls it". Fix: allow-list provider sources, verify signatures, and route through the WAF.
- Record the flow matrix and the list of protected endpoints.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.