# Defence in Depth and Egress Control — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-defense-depth

> Layer network controls so that a single mistake does not expose a system, and restrict what workloads can send out.

## No single control should be load-bearing

**Defence in depth** means stacking independent controls so one failure is not a breach. In a VPC the layers are: private subnets with no inbound internet path; network ACLs for coarse subnet boundaries; security groups for per-workload rules; a web application firewall in front of public HTTP endpoints; and identity-based access for administration instead of open SSH. Teams often guard inbound traffic carefully and leave **egress** wide open. Yet an attacker who compromises an app server will try to download tools and send data out. Egress controls include routing internet-bound traffic through a managed firewall that allows only approved domains (AWS Network Firewall, Google Cloud's Cloud NGFW, Azure Firewall), using VPC endpoints with restrictive policies for provider services, and tightening outbound security group rules for sensitive tiers such as databases. Finally, monitor: flow logs and threat-detection services turn silent failures into alerts.

## Layers of control

A request from outside meets three layers before reaching data: the perimeter (internet-facing load balancer and web firewall), the subnet boundary (route tables and NACLs), and the workload boundary (security groups and host controls).

![Three connected stages from left to right: perimeter, subnet boundary, workload boundary.](assets/figures/cloud-networking/section-10-map.svg) — Figure 10.1: perimeter -> subnet boundary -> workload boundary

## Airport security

An airport does not rely on one guard. There is an entry check, a security scan, a boarding-gate check and crew on the plane. If one check misses something, another catches it. Your network should be built the same way.

**Quiz:** Why restrict outbound (egress) traffic from a database subnet?

- [ ] It makes queries run faster
- [ ] Security groups require at least one outbound rule
- [ ] Outbound traffic is the only traffic billed
- [x] It limits data exfiltration and tool downloads after a compromise

*Answer:* It limits data exfiltration and tool downloads after a compromise. A compromised host typically reaches out to an attacker. Tight egress limits what it can send and fetch.