Defense in Depth

Defense in Depth assumes that individual security controls can fail, be bypassed, or be misconfigured. Instead of relying on a perimeter firewall alone, an architecture combines controls that address different attack paths and failure modes. For example, an internet-facing application might use distributed denial-of-service protection, HTTP request filtering, restricted origin access, workload-level network rules, application authorization, and database permissions. If an attacker bypasses request filtering, authorization and data-access controls still constrain what the attacker can do.

Cloud network segmentation applies this principle by separating resources according to trust, sensitivity, and required communication. North/south traffic crosses a defined environment boundary, such as traffic between the internet and an application. East/west traffic moves between internal workloads, such as an application server connecting to a database. These directions are relative to the architectural boundary being discussed. Protecting only internet ingress leaves lateral movement paths available after a workload is compromised.

A practical three-tier design places public entry points in internet-facing subnets, application workloads in private subnets, and databases in isolated subnets. Only the entry point can reach the application port, and only the application tier can reach the database port. An isolated subnet has no route to an internet gateway or NAT gateway, but it is not automatically disconnected from other internal networks. Local routes, transit connections, endpoints, and resource-level rules still determine possible communication. A subnet boundary by itself does not enforce isolation.

On AWS, security groups provide stateful, resource-level filtering, while network ACLs provide stateless subnet-boundary filtering. Network ACL rules must account for return traffic, including applicable ephemeral ports. Security groups can restrict permitted connections between application tiers; subnet ACLs can provide broader boundary restrictions. Neither replaces application authorization. Where centralized network inspection is required, routing must actually steer the relevant traffic through the firewall. Stateful inspection also requires a supported symmetric traffic path, including during failover.

Edge controls should match anticipated threats. Volumetric attacks call for distributed infrastructure and DDoS defenses; malicious HTTP requests call for application-layer filtering; abusive request rates may require rate limits or bot controls. A web application firewall does not inspect arbitrary non-HTTP protocols and cannot replace secure application code. A CDN does not prevent attackers from contacting a publicly reachable origin unless origin access is restricted separately. Use private origin connectivity where supported, or combine network restrictions and origin request validation to prevent direct-origin bypass.

Defense also extends to outbound connections, administrative access, and data access. Restrict unnecessary egress to reduce command-and-control and exfiltration paths, use narrowly scoped workload identities, and authenticate administrative sessions independently of network location. Encryption protects confidentiality but does not stop an authorized, compromised workload from reading data it is permitted to access. Network flow records, firewall logs, application logs, and identity audit events provide complementary evidence for detection and investigation.

Additional layers introduce cost, latency, operational complexity, and potential availability failures. Select controls for explicit threats rather than duplicating the same rule everywhere without a purpose. During troubleshooting, trace DNS resolution, routing, inspection paths, network rules, and application decisions in sequence; a timeout alone does not identify the blocking layer. Test expected connections, prohibited connections, origin-bypass attempts, and failure scenarios. The goal is independent protection with manageable operations, not the largest possible number of security products.