Cloud Firewall:Best practices for securing outbound traffic with NAT Gateway and NAT Firewall

Security challenges of outbound traffic

As network attacks become more sophisticated, enterprise security faces greater challenges. An organization's cloud workloads typically handle both inbound traffic from the internet and outbound traffic initiated by business assets. However, when considering network protection, most security teams focus on inbound traffic and deploy comprehensive security measures for it. The security of outbound traffic is often overlooked, creating a weak point in the security posture of many organizations. If an attack bypasses inbound defenses and penetrates the internal network, it can lead to data theft, malware downloads, or connections to malicious command and control (C&C) servers. In addition, due to lapses in security management, internal personnel might make unauthorized external connections or visit malicious websites, leading to risks such as sensitive data leakage.

Enterprises need to be aware of the following potential security risks associated with outbound traffic:

• Malware compromise risk

  When attackers bypass inbound security measures and compromise internal workloads, they often establish outbound callback connections to malicious command and control (C&C) servers to perform actions such as downloading ransomware. In an attack chain, malware infection is often one of the initial stages of a larger-scale attack. Many types of malware need to communicate with a C&C server to establish a connection, receive updates, request commands, and exfiltrate stolen data. Certain types of ransomware, botnets, and crypto-mining activities all require outbound callback connections. It is crucial to promptly alert and block these malicious outbound connections to prevent further damage to an enterprise's IT infrastructure, digital assets, and development systems.

• Data exfiltration risk

  Stealing high-value enterprise data is often the primary goal of attackers. Once an attack is successful, an attacker can obtain valuable enterprise data, such as financial data, credentials, emails, and personally identifiable information (PII). This data is then exfiltrated over the network for malicious activities such as illicit sales, financial fraud, and identity theft. Attackers can also use the stolen information to escalate privileges or access more sensitive systems, posing even greater destructive risks to the enterprise.

• Insider risk

  Due to a lack of security awareness or lapses in corporate security management, internal personnel might access insecure web services, geographic locations, or IP addresses during system development or maintenance. They might also intentionally upload sensitive corporate data to public or open-source platforms like GitHub, creating risks of intrusion and data leakage. It is essential to effectively monitor these risky behaviors, issue timely alerts, block them, and conduct further audits for traceability.

• Supply chain risk

  Even if an enterprise has a robust security system, its business may involve third-party development systems or require interconnection with suppliers and subsidiaries. If a supplier or subsidiary is compromised due to inadequate security, the attack can spread to the enterprise and initiate malicious outbound connections. This requires the enterprise to monitor and audit traffic from its supply chain to enable rapid incident response and damage control when an attack is discovered.

• Outbound traffic compliance risk

  Some industry regulators and internal audit teams have imposed clear and stringent requirements for outbound traffic to enhance system security. For example, Requirement 1.3.2 of the Payment Card Industry Data Security Standard (PCI DSS) v4.0 mandates restricting outbound traffic that originates from the cardholder data environment (CDE). According to the requirement, only traffic deemed necessary is allowed, and all other outbound traffic must be blocked. This requirement aims to prevent malicious individuals and compromised system components within the entity's network from communicating with untrusted external hosts. Therefore, enterprises must also implement strict security management and auditing for outbound traffic.

Solution

To manage outbound traffic security, enterprises can adopt a solution that combines a nat gateway and a nat firewall to effectively monitor and protect outbound traffic.

• A nat gateway allows cloud servers to provide public-facing services and access the internet by using custom SNAT entries. With the SNAT capability of a nat gateway, when an ECS instance initiates an outbound connection, it accesses the internet through an EIP from the SNAT address pool. This prevents the private network from being directly exposed to the public internet, enhancing asset security.

• The nat firewall is a security feature of Cloud Firewall. It provides Layer 4 to Layer 7 traffic protection for resources within a VPC, such as ECS and Elastic Container Instance (ECI) instances, that access the internet through a nat gateway. The nat firewall audits and intercepts unauthorized access to reduce security risks such as unauthorized access, data exfiltration, and malicious traffic attacks. Compared to the SNAT entries of a nat gateway, the access control policies of Cloud Firewall provide fine-grained control over destination IP addresses, destination domain names, destination regions, protocols, ports, and applications.

Solution architectures

Deployment

Maintenance

Analyze unusual traffic

Maintenance recommendations

If you identify an unusual traffic spike and determine that the traffic is legitimate and required for your business, consider the following recommendations:

• Increase the Cloud Firewall protection bandwidth

  For more information, see Renewal.

• Optimize workload deployment

  For example, if your business needs to access Alibaba Cloud services such as OSS or SLS, use an internal endpoint to save public network bandwidth.

• Disable Cloud Firewall for IP addresses that do not require protection

  For more information, see Disable a nat firewall.