Network Security (TLS, Firewalls, VPCs)

📘 Chapter 13: Security Architecture ⏱️ 9 min read 🏗️ Lesson 055

The network is hostile. Whether it's the public internet or your internal network, you must assume attackers can see and modify traffic. Defense in depth means multiple overlapping layers of security — if one fails, others still protect you.

Network Architecture: Defense in Depth

VPC Network Architecture ☁️ Internet Public Subnet (DMZ) Load Balancer NAT Gateway Bastion Host Private Subnet (Application) App Server A App Server B Cache Private Subnet (Data Layer) Primary DB Replica DB SG: 443 in SG: LB only SG: App only
Figure 1: Three-tier VPC architecture — each layer only accepts traffic from the layer above it.

TLS: Protecting Data in Transit

Simplified TLS Handshake

  1. Client Hello: Client sends supported cipher suites and a random number
  2. Server Hello: Server picks a cipher suite, sends its certificate
  3. Certificate Verification: Client verifies cert against trusted CAs
  4. Key Exchange: Both sides derive a shared session key (Diffie-Hellman)
  5. Encrypted Communication: All data encrypted with session key

Result: Confidentiality (can't read), integrity (can't modify), authenticity (talking to who you think).

mTLS: Mutual Authentication

Standard TLS: only the server proves its identity. Mutual TLS (mTLS): both sides present certificates.

  • Server verifies client's certificate (is this a legitimate service?)
  • Client verifies server's certificate (am I talking to the real service?)
  • Use case: Service-to-service communication in microservices
  • Implementation: Service meshes (Istio, Linkerd) handle mTLS automatically

mTLS eliminates the need for API keys between internal services — identity is cryptographic.

VPCs and Network Segmentation

Component Purpose Accessible From
Public subnet Internet-facing resources (LB, NAT, bastion) Internet (specific ports only)
Private subnet App servers, caches, workers Public subnet only (via LB)
Data subnet Databases, storage Private subnet only
NAT Gateway Outbound internet for private instances N/A (outbound only)
Security Groups Instance-level firewall (allowlist rules) Defined per resource

Firewalls & Security Groups

Allowlist vs Blocklist

  • Allowlist (default-deny): Block everything, explicitly permit what's needed → more secure, preferred
  • Blocklist (default-allow): Allow everything, explicitly block known threats → easy to miss something

Layers of Firewalling

  • Network ACLs: Subnet-level, stateless, processed in order
  • Security Groups: Instance-level, stateful, all rules evaluated
  • WAF (Web Application Firewall): Layer 7, inspects HTTP content

Real-World Examples

AWS VPC: Isolating Production from Staging

Best practice: production and staging live in separate VPCs (or even separate AWS accounts). VPC peering connects them only where needed (e.g., shared monitoring). This prevents a staging misconfiguration from leaking production data. Security groups ensure databases only accept connections from app servers in the same VPC — not from the internet, not from staging.

Google BeyondCorp: Zero-Trust Networking

Traditional model: everything inside the corporate network is trusted. Google's BeyondCorp flips this — no network is trusted. Every request is authenticated and authorized regardless of network location. Access depends on device state, user identity, and context — not which WiFi you're on. This eliminated the VPN for 100,000+ Google employees.

Interactive: Design a Network Topology

Place Services in the Correct Subnet

For each service, decide where it belongs: