Back to Documentation
Security

Network Security Best Practices: Ruthless Segment Isolation

Deploying ruthless segment isolation strategies to guard mission critical deployments.

For large-scale, private cloud production deployments, CXMind’s security requirements are dogmatic. We strictly forbid any core architectural components—along with their underlying VM interfaces or Docker daemons—from possessing direct routing paths to the WAN. We advocate for a deeply restrictive 3-Tier VPC topology to establish fortified defensive baselines protecting the core ingestion grid.

1. The 3-Tier VPC Topology Architecture

By enforcing physical and logical isolation, we ensure that core data remains "offline" and protected even if edge nodes are compromised.

Public Subnet (DMZ)

Deploys only Load Balancers (ALB/NLB) and Bastion Hosts. This is the only zone allowed to perform limited handshakes with external traffic.

Private App Subnet

Houses the Ingestion Engines and AI Processing nodes. No public IPs are assigned here. All necessary outbound requests to the WAN (e.g., Third-party ASR APIs) must pass through controlled NAT Gateways or Private Endpoints (PrivateLink).

Isolated Data Subnet

Contains the Redis State Center, MongoDB, and storage systems. This subnet has zero routing to the public internet and exclusively accepts internal traffic from the Private App Subnet.

2. VoIP-Specific Security Hardening

Due to the unique nature of SIP/RTP protocols, traditional firewall policies are often insufficient.

  • Signaling & Media Separation:Strictly limit SIP ports (UDP 5060/9060) to accept traffic only from whitelisted IPs, such as designated carrier SBCs or Cloud Gateways.
  • Mandatory SRTP Encryption:Within the ingestion grid, all media streams must be transported via SRTP. Keys are generated and destroyed in volatile memory on-the-fly, ensuring that voice content remains indecipherable even if internal links are sniffed.
  • BPF Drop Policies:Utilize Linux Kernel BPF filters to discard malformed, non-HEP/SIP packets at the lowest level of the network stack, preventing high-velocity Denial of Service (DoS) attacks.

3. Zero Trust & Management Plane Security

  • JIT (Just-In-Time) Access:Permanent SSH access for administrators is prohibited. All maintenance must be authorized via short-lived tokens protected by Multi-Factor Authentication (MFA).
  • Silent Interaction Tokens:Leveraging the dual-token mechanism in RBAC v2.0, every command issued between the Control Plane and the Data Plane is verified via strong cryptographic signatures.
  • Sidecar Proxy Isolation:In Dockerized environments, we recommend using a Sidecar pattern to handle outbound encryption, completely decoupling the core container logic from the network transparency layer.

Need more help or have a specific architecture question?

Contact Engineering Support