Certified Cloud Security Professional (CCSP)Cloud Concepts, Architecture and DesignHard
A cloud security engineer is tasked with securing a critical application hosted on a public cloud, which processes financial transactions. The application relies on several microservices interacting with each other. The engineer wants to ensure that even if one microservice is compromised, the attacker cannot easily pivot to other microservices or the underlying host. Which cloud security best practice, related to network segmentation, would be most effective in achieving this goal?
- ADeploying Intrusion Detection Systems (IDS) on all virtual machines.
- BImplementing a Web Application Firewall (WAF) at the edge.
- CUtilizing Security Groups or Network Access Control Lists (NACLs) to restrict microservice communication.
- DEnforcing strong password policies for all service accounts.
Show answer & explanationAnswer & explanation
Correct answer: C. Utilizing Security Groups or Network Access Control Lists (NACLs) to restrict microservice communication.
Utilizing Security Groups or NACLs to restrict microservice communication implements network segmentation, creating 'micro-perimeters' around individual services. This limits lateral movement within the cloud environment, preventing an attacker from easily pivoting from a compromised microservice to others.
Why the other options are wrong
- A. IDS detects attacks but doesn't prevent lateral movement via network controls.
- B. WAF protects against web-based attacks but doesn't directly segment internal microservice communication.
- D. Strong passwords are for authentication, not for network segmentation or preventing lateral movement after a service is compromised.
Network Segmentation (Micro-segmentation)
The practice of dividing a network into smaller, isolated segments to limit lateral movement of threats and reduce the attack surface.
- Crucial for limiting blast radius in cloud environments
- Implemented using Security Groups, NACLs, or firewalls
- Enhances zero-trust architecture principles
Memory trick: Segment your network, stop the spread.