Lateral movement - with a Cloud perspective

Your typical enterprise VPC is most likely connected to your office location via VPNs or possibly fibre, and your VPC-deployed workload may be offering services to your internal office network. With that connectivity in place, your lateral movement vector could be from on-premise to in cloud, or vice-versa.

Traditionally, your office network is often done on shared segments of networks. There can be several systems connected to the same ethernet switch, or the same Wi-Fi access point. Those networks connect to routers or firewalls, which police the boundary of that shared segment, but do nothing for the security of the individual assets sitting alongside each other in the same network segment.

The granularity of the firewall is often the shared network segment. In the AWS environment, that granularity is not the same; two hosts sitting in the same logical network segment (a subnet) may be members of two completely different Security Groups. A Security Group is a Stateful firewall, meaning that you only need to define the incoming or outgoing service that you wish to permit, and the return traffic for that connection is automatically matched and permitted (the alternate is a Network ACL, which requires both the outbound and inbound packets to be permitted to connect as two separate policies).

Your EC2-deployed resources, which include Virtual Machines (EC2), managed databases (RDS), managed Load Balancers (ELB/ALB/NLB), managed cache services (ElasticCache), VPC-attached serverless Lambda functions and more, also have Network Interfaces (ENIs) that are present within your Virtual Private Cloud network, and each must be a member of one or more Security Groups.

With every VPC, there is a Security Group called “Default”, and its initial configuration is to permit no traffic inbound, but to permit all outbound traffic. As a recommendation do not modify any inbound rules for this default. Any service you deploy should have a carefully thought-out connectivity plan, and not left to a generic default. If you find services using a Security Group called “Default”, or “launch-wizard-nnnn”, then that’s evidence that your deployment needs attention to ensure the appropriateness of the network security. In addition, with this Default Security Group, it permits all egress (outbound). Therefore, change the default to permit nothing outbound. If this group were to be accidentally used as a resource, then it should not add any ability for either inbound or outbound traffic.