Implement inspection and protection

Ensuring the security of your network resources is vital in safeguarding against both external and internal threats. By implementing a multi-layered defense strategy, you can inspect, filter, and manage traffic to create stronger protections against various attacks and vulnerabilities.

Best Practices

Implement Network Traffic Inspection

• Utilize AWS VPC Network Access Analyzer to assess your VPC configurations for any unintended access paths. This proactive inspection helps in identifying vulnerabilities in your network setup.
• Deploy AWS GuardDuty for continuous monitoring of malicious or unauthorized behavior within your AWS environment. GuardDuty can detect anomalous API calls, account compromise, and other threats effectively.
• Regularly review and strengthen security group rules and network ACLs to enforce the principle of least privilege. This means limiting traffic to only what is necessary for your applications to function.

Integrate Web Application Firewall (WAF)

• Implement AWS WAF to protect your web applications from common exploits that could affect application availability, compromise security, or consume excessive resources.
• Create custom rules that align with your application use case. This can include rules to protect against SQL injection and cross-site scripting (XSS).
• Combine AWS Managed Rules with your own custom rules to benefit from a community-driven approach while tailoring security to your specific needs.

Utilize Encryption for Data in Transit

• Ensure all data transmitted across your network is encrypted using protocols such as TLS to protect sensitive information from being intercepted.
• Configure AWS services to enforce TLS connections where applicable, which includes load balancers and API Gateway.

Monitor and Audit Network Activities

• Leverage AWS CloudTrail to log and monitor API calls made on your account. This provides visibility into user activity and helps in the detection of unauthorized actions.
• Set up Amazon CloudWatch alarms to alert on unusual traffic patterns or potential attacks, enabling quick response to threats.

Questions to ask your team

• Have you implemented a VPC Network Access Analyzer to evaluate network configurations for unintended access?
• What measures are in place to monitor and filter traffic at each network layer?
• Are you using AWS WAF or any other web application firewall to protect your web applications against common attacks?
• Have you configured custom rules in addition to AWS Managed Rules for your web application firewall?
• Is there an ongoing review process to adapt your traffic inspection and filtering as your application evolves?

Who should be doing this?

Cloud Security Architect

• Design and implement security architectures for network resources.
• Ensure the deployment of multi-layered security measures to protect against threats.
• Select and configure AWS WAF with appropriate rules for traffic filtering.
• Regularly review and update security policies and firewall rules.

Network Security Engineer

• Conduct inspections of network traffic and configurations using VPC Network Access Analyzer.
• Monitor network traffic for unusual patterns or potential threats.
• Implement and manage the configuration of network access controls.
• Collaborate with the Cloud Security Architect to apply security best practices.

DevOps Engineer

• Integrate security practices into the CI/CD pipeline.
• Automate the deployment of security tools and updates.
• Ensure compliance with security measures during application deployment.
• Work alongside security teams to implement findings from network security inspections.

What evidence shows this is happening in your organization?

• Network Security Inspection Policy: A comprehensive policy that outlines procedures for inspecting and filtering network traffic, including the use of AWS WAF and VPC Network Access Analyzer to identify potential vulnerabilities and safeguard against unauthorized access.
• Traffic Filtering Checklist: A detailed checklist for implementing traffic filtering mechanisms within AWS infrastructures, ensuring all necessary configurations and rules are applied for AWS WAF and VPC settings.
• Network Protection Strategy Document: A strategic document outlining the multi-layered approach to network security, including the integration of AWS Managed Rules with customer-defined rules to enhance protection against network threats.
• AWS WAF Configuration Playbook: A practical playbook detailing the step-by-step guide for configuring AWS WAF, including the implementation of custom rules and the integration of existing partner solutions for enhanced security.
• VPC Security Diagram: A visual diagram illustrating the architecture of the VPC with implemented security measures, showing layers of defenses, traffic inspection points, and how different AWS services interact to secure network resources.
• Incident Response Runbook for Network Threats: A runbook designed to guide teams in responding to identified network threats, detailing the actions to take once an intrusion or vulnerability is detected, including the use of inspection tools.

Cloud Services

AWS

• AWS WAF: AWS WAF helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.
• AWS Shield: AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS.
• Amazon VPC Network Access Analyzer: This tool helps you identify network access configurations that can lead to unintended access to your Amazon VPC resources.
• AWS Config: AWS Config enables you to assess, audit, and evaluate the configurations of your AWS resources, providing the visibility you need to maintain security compliance.

Azure

• Azure Firewall: Azure Firewall is a managed, cloud-based network security service that protects Azure Virtual Network resources.
• Azure DDoS Protection: Azure DDoS Protection provides enhanced DDoS attack mitigation for your Azure applications.
• Azure Network Security Groups: Network Security Groups (NSGs) contain security rules that allow or deny inbound or outbound network traffic to and from the Azure resources.
• Azure Bastion: Azure Bastion provides secure and seamless RDP and SSH connectivity to your virtual machines directly through the Azure portal.

Google Cloud Platform

• Google Cloud Armor: Google Cloud Armor provides DDoS protection and helps protect your backend services from attacks.
• Identity-Aware Proxy (IAP): IAP secures applications by controlling access to your applications based on the identity of the user and the context of their request.
• Cloud Pub/Sub: Cloud Pub/Sub provides a reliable way to send and receive messages between independent applications, ensuring a secure communication channel.
• Google Cloud VPC Firewall Rules: Firewall rules allow you to define the traffic allowed to and from your Virtual Private Cloud (VPC) network resources.

Question: How do you protect your network resources?
Pillar: Security (Code: SEC)