Defence in Depth and Egress Control

No single control should be load-bearing

Defence in depth means stacking independent controls so one failure is not a breach. In a VPC the layers are: private subnets with no inbound internet path; network ACLs for coarse subnet boundaries; security groups for per-workload rules; a web application firewall in front of public HTTP endpoints; and identity-based access for administration instead of open SSH. Teams often guard inbound traffic carefully and leave egress wide open. Yet an attacker who compromises an app server will try to download tools and send data out. Egress controls include routing internet-bound traffic through a managed firewall that allows only approved domains (AWS Network Firewall, Google Cloud's Cloud NGFW, Azure Firewall), using VPC endpoints with restrictive policies for provider services, and tightening outbound security group rules for sensitive tiers such as databases. Finally, monitor: flow logs and threat-detection services turn silent failures into alerts.

Layers of control

A request from outside meets three layers before reaching data: the perimeter (internet-facing load balancer and web firewall), the subnet boundary (route tables and NACLs), and the workload boundary (security groups and host controls).

Airport security

An airport does not rely on one guard. There is an entry check, a security scan, a boarding-gate check and crew on the plane. If one check misses something, another catches it. Your network should be built the same way.

Quick check: Why restrict outbound (egress) traffic from a database subnet?

• It makes queries run faster
• Security groups require at least one outbound rule
• Outbound traffic is the only traffic billed
• It limits data exfiltration and tool downloads after a compromise