3.4.2.5. Combining Security Controls for Defense in Depth (ACM, WAF, Config, Security Hub, GuardDuty, Detective, Network Firewall)
First Principle: Creating multiple protective barriers ensures that if one layer is breached, others prevent or detect intrusion, significantly enhancing resilience.
The principle of security is layered defense: no single control is foolproof. Defense-in-depth builds this posture. AWS services integrate to build this posture:
- AWS Certificate Manager (ACM): Manages SSL/TLS certificates for data in transit encryption.
- AWS WAF: Protects web applications from common exploits.
- AWS Network Firewall: Provides network traffic filtering at the VPC level.
- AWS Config: Continuously monitors resource configurations for compliance.
- Amazon GuardDuty: Offers intelligent threat detection for malicious activity.
- Amazon Detective: Simplifies security investigations by linking log data.
- AWS Security Hub: Centralizes security alerts and posture management.
Key Security Controls & Their Roles:
- Prevention: ACM (encryption), WAF (web exploits), Network Firewall (VPC traffic filtering).
- Detection: Config (compliance), GuardDuty (threats), Detective (investigation), Security Hub (aggregation).
Scenario: A DevOps team is building a new critical web application and needs to implement a robust security posture using a "defense-in-depth" approach. They want to encrypt all traffic, protect against web exploits and network-level attacks, monitor for threats, and centralize security findings.
Reflection Question: How would you combine AWS Certificate Manager (ACM), AWS WAF, AWS Network Firewall, Amazon GuardDuty, and AWS Security Hub to create a layered defense-in-depth strategy for this application, ensuring comprehensive protection from the edge to the application?
This integration forms a robust, proactive framework. WAF, Network Firewall, and ACM provide preventative layers. Config ensures compliance, while GuardDuty and Detective offer detection and investigation. Security Hub unifies findings. This multi-layered approach ensures comprehensive protection from edge to application, with continuous monitoring.
š” Tip: Consider how each service addresses a different attack vector or stage of a security incident.