Mastering Defense in Depth: Orchestrating AWS Security Controls

This study guide focuses on the integration and automation of AWS security services to create a layered defense strategy (Defense in Depth). As part of the AWS Certified DevOps Engineer - Professional curriculum, this section emphasizes how to combine networking, identity, and monitoring controls to protect multi-account environments.

Learning Objectives

After studying this guide, you should be able to:

• Architect a layered security model using AWS native services.
• Integrate AWS Security Hub with services like GuardDuty and AWS Config for centralized visibility.
• Distinguish between various network security controls (SGs, NACLs, WAF, Network Firewall).
• Automate security remediation using AWS Config Rules and EventBridge.
• Implement PKI and certificate management via AWS Certificate Manager (ACM).

Key Terms & Glossary

• Defense in Depth: A security strategy where multiple layers of defense are placed throughout an IT system to provide redundancy in case a security control fails.
• Finding: A standardized record of a security detection or compliance check (used primarily in Security Hub).
• Insight: In Security Hub, a collection of related findings grouped to identify a specific area requiring attention.
• Stateful vs. Stateless: Stateful controls (Security Groups) remember the context of traffic, while stateless controls (NACLs) treat every packet in isolation.
• Public Key Infrastructure (PKI): A system for managing digital certificates; in AWS, this is largely handled by AWS Certificate Manager (ACM).

The "Big Idea"

Think of AWS security not as a single wall, but as a series of concentric circles. If an attacker bypasses the outermost layer (e.g., AWS Shield/WAF), they are immediately met by the next (e.g., Network Firewall), and then the next (e.g., Security Groups). The "Big Idea" is that visibility (Security Hub) and automation (Config Rules) are the glue that binds these layers together, ensuring that a breach in one layer triggers an automated response across the others.

Formula / Concept Box

Hierarchical Outline

1. Network Protection Layers
   • External Layer: AWS WAF (Web Application Firewall) filters Layer 7 traffic (SQLi, XSS).
   • VPC Boundary: AWS Network Firewall provides stateful inspection across the entire VPC.
   • Subnet Layer: Network ACLs (NACLs) act as a stateless firewall for the subnet.
   • Instance Layer: Security Groups (SGs) act as a stateful firewall for ENIs.
2. Compliance & Monitoring
   • AWS Config: Records configuration changes and evaluates against rules (e.g., "Is encryption enabled?").
   • Amazon GuardDuty: Intelligent threat detection using VPC Flow Logs, CloudTrail, and DNS logs.
   • AWS Security Hub: The "Single Pane of Glass" that aggregates findings from GuardDuty, Inspector, and Config.
3. Identity & Automation
   • ACM: Automates the rotation and deployment of SSL certificates.
   • Automated Remediation: Using EventBridge to trigger Lambda functions when a Security Hub finding is generated.

Visual Anchors

Layered Traffic Flow

Security Hub Finding Aggregation

Definition-Example Pairs

• AWS WAF: A web application firewall that monitors HTTP/HTTPS requests.
  • Example: Creating a rule to block all requests originating from a specific list of malicious IP addresses known for SQL injection attacks.
• Amazon Detective: A service that makes it easy to analyze, investigate, and quickly identify the root cause of potential security issues.
  • Example: After GuardDuty flags an unusual API call, using Detective to visualize the relationship between an IAM role and the IP addresses it communicated with over the last week.
• AWS Config Rule: A logic set to evaluate the configuration of AWS resources.
  • Example: A rule that checks whether all EBS volumes in an account are encrypted; if a non-compliant volume is found, it marks it as "Non-compliant" in Security Hub.

Worked Examples

Scenario: Remediating an Overly Permissive Security Group

Problem: A DevOps engineer notices that a Security Group allows SSH (port 22) from 0.0.0.0/0.

Step-by-Step Solution:

1. Detection: AWS Config evaluates the resource against the restricted-common-ports managed rule.
2. Notification: Config sends the non-compliance finding to AWS Security Hub.
3. Automation: Security Hub triggers a Custom Action (or an EventBridge rule listens for that specific finding).
4. Remediation: An AWS Lambda function is invoked. It uses the ec2:RevokeSecurityGroupIngress API call to remove the permissive rule.
5. Audit: AWS CloudTrail records the Lambda's action, ensuring a permanent record of the change exists for compliance auditors.

Checkpoint Questions

1. What is the primary difference between how Security Groups and Network ACLs handle return traffic?
2. Which service should you use if you need to perform deep packet inspection (DPI) for non-HTTP protocols between subnets?
3. How does AWS Security Hub normalize findings from different services like GuardDuty and Inspector?
4. You need to investigate a complex security incident involving multiple AWS accounts. Which service provides a graph-based visualization of resource relationships to assist you?

Muddy Points & Cross-Refs

• GuardDuty vs. Detective: GuardDuty is the "Security Guard" (it alerts you when something is wrong). Detective is the "Private Investigator" (it helps you figure out why and how it happened after the alert).
• WAF vs. Network Firewall: WAF is strictly for Web traffic (Layer 7). Network Firewall can handle any IP traffic (Layers 3-7) and is typically deployed at the VPC ingress/egress points.
• Config Rules vs. Security Hub Controls: Config provides the raw compliance data, while Security Hub provides the consolidated dashboard and industry-standard scores (like CIS Benchmarks).

Comparison Tables

Security Group (SG) vs. Network ACL (NACL)

WAF vs. Shield vs. Network Firewall

[!TIP] For the DOP-C02 exam, always prioritize Security Hub as the central point for multi-account finding management and AWS Config for resource-level compliance automation.