Firewalls and Security Groups

Definition

Firewalls and security groups filter traffic by source, destination, port and protocol. Security groups in cloud environments are typically stateful and instance-attached; network ACLs are stateless and subnet-attached; traditional firewalls sit at a boundary.

What network controls are good and bad at

Good at: reducing attack surface, containing lateral movement after a compromise, and providing a coarse, auditable statement of what may talk to what. A database that accepts connections only from the application tier's security group cannot be reached from a compromised web server in another subnet.

Bad at: identity. A network rule says "this address may connect", not "this service, with this identity, may perform this action". Anything that reaches the right network position inherits the trust, and in a modern estate addresses are ephemeral and shared.

The shift away from the perimeter

The perimeter model — hard shell, soft interior — assumed that being inside the network meant being trusted. That assumption fails against remote work, cloud services, contractors, and the reality that most serious breaches involve an attacker who is already inside.

Google's BeyondCorp work is the widely cited articulation of the alternative: trust is derived from the identity of the user and the state of the device, evaluated per request, rather than from network location. There is no privileged network. A request from the office and a request from a coffee shop are treated identically, and both are authenticated and authorised on their merits.

The architectural consequence is that authorisation moves into the application and service layer, where the semantics live, and network controls become a defence-in-depth layer rather than the primary control. Both still matter; the ordering changed.

Failure scenarios

• Overly broad rules that become permanent. A rule opened to 0.0.0.0/0 for a debugging session, never closed, discovered by a scanner.
• Rules by IP in an ephemeral environment, which break constantly and get widened until they are meaningless.
• Egress unfiltered. Ingress is usually controlled and egress usually is not, which is precisely the path data exfiltration takes.
• Trusting the network — a service that accepts any request arriving from inside the VPC, so one compromised workload can call everything.
• Rules nobody can explain, accumulated over years, that nobody dares remove.

Trade-offs

Network controls are cheap, coarse and enforceable independently of application code — genuinely valuable. They are also insufficient alone, and treating them as the primary control produces a brittle estate where the only thing standing between an attacker and everything is one compromised host.

Interview question

"An attacker compromises one container in your cluster. Describe what your network controls should prevent, and what they cannot help with."