Network security components (for example, security groups, network ACLs, routing, AWS Network Firewall, AWS WAF, AWS Shield)

Can you explain the purpose of security groups in an AWS environment and how they differ from network ACLs?

Security groups in AWS act as a virtual firewall for an EC2 instance to control inbound and outbound traffic. They operate at the instance level and support allow rules only. Network ACLs, on the other hand, operate at the subnet level, support both allow and deny rules, and are stateless, meaning they do not track the state of network connections.

What is the difference between stateful and stateless traffic filtering, and how do these concepts apply to AWS Network ACLs and security groups?

Stateful traffic filtering tracks the state of active connections and automatically allows the return traffic to flow, regardless of any rules. AWS security groups are stateful. Stateless filtering, found in AWS network ACLs, does not track the state of connections and requires rules to allow the return traffic explicitly.

How can AWS WAF help protect your web applications, and what types of threats can it mitigate?

AWS WAF helps protect web applications from common web exploits and bot attacks by controlling traffic based on conditions such as IP addresses, HTTP headers, HTTP body, URI strings, SQL injection, and cross-site scripting. It can mitigate threats like DDoS attacks, SQL injection, and XSS.

Describe what AWS Shield is and the difference between AWS Shield Standard and AWS Shield Advanced.

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service. AWS Shield Standard provides basic DDoS protection for all AWS customers at no additional charge and is automatically included with AWS services. AWS Shield Advanced provides enhanced protection for an additional cost, with features like 24/7 support, detailed attack diagnostics, and protection against larger and more sophisticated attacks.

In AWS, what role does the routing table play in network security?

In AWS, the routing table determines how network traffic is directed within virtual private clouds (VPCs). It can provide an additional layer of security by ensuring that only the desired traffic can route between subnets or to the internet, by specifying the routes to various network interfaces and subnets.

How does AWS Network Firewall complement the existing security services like security groups and network ACLs?

AWS Network Firewall provides a layer of protection at the VPC level, offering stateful inspection of traffic, intrusion detection and prevention, and web filtering. It complements security groups and network ACLs by providing finer-grained control, monitoring capabilities, and protecting against more complex threats that require deep packet inspection or signature-based detection.

How would you set up AWS WAF to protect against SQL injection attacks?

To protect against SQL injection with AWS WAF, you would create a web ACL and add a rule that includes a string match or a regex pattern set designed to detect SQL code often found in SQL injection attacks. Any requests that match these patterns can then be blocked or counted for further analysis.

What considerations should be taken into account when configuring network ACLs for a multi-tier architecture in AWS?

When configuring network ACLs for a multi-tier architecture, considerations include the principle of least privilege, ensuring only necessary ports and protocols are open, understanding the stateless nature of ACLs, maintaining proper network segmentation, and logging and auditing traffic for anomalies.

Explain how AWS Shield Advanced provides DDoS cost protection.

AWS Shield Advanced gives financial safeguards against the scaling costs resulting from a DDoS attack. It includes features such as DDoS cost protection, which reimburses customers for scaling charges that occur directly as a result of a DDoS attack on their protected resources.

Discuss how AWS Network Firewall’s intrusion detection and prevention feature works.

AWS Network Firewall’s intrusion detection and prevention feature inspects network traffic for malicious activity or traffic patterns that match known attack signatures. When a threat is detected, AWS Network Firewall takes the predefined action, such as alerting, dropping the traffic, or resetting the connection.

What is the relationship between Route Tables and Internet Gateways in an AWS VPC, and how do they impact network security?

Route Tables define the allowed routes for outbound and inbound traffic within a VPC. An Internet Gateway allows a VPC to connect to the internet. To impact network security, Route Tables can direct traffic to or from the Internet Gateway, controlling which resources can access or be accessed from the internet.

Can you describe the difference between AWS Managed Rules for AWS WAF and custom rules that users can define?

AWS Managed Rules for AWS WAF are pre-configured rule sets created by AWS or AWS Marketplace sellers designed to address common web security concerns like OWASP Top 10 threats. Custom rules in AWS WAF are created by users, tailored to their specific application’s traffic patterns for fine-grained control over what is allowed or blocked.