Cloud Network and Infrastructure Security

Introduction and Context

Cloud security depends not only on identity controls and encryption but also on how traffic is allowed to move. A cloud network is a logical infrastructure composed of virtual networks, subnets, routes, gateways, firewalls, load balancers, name-resolution services, and private connectivity mechanisms. Poor network design can expose management interfaces, permit unnecessary lateral movement, or make an otherwise secure application vulnerable to denial-of-service and web attacks.

This chapter explains how to design and operate secure cloud networks. It focuses on virtual networks, segmentation, routing, security groups, network firewalls, private connectivity, DNS, web application firewalls (WAFs), and distributed denial-of-service (DDoS) protection. The emphasis is on essential concepts and practical foundations suitable for certificate-level study.

Learning Objectives

By the end of this chapter, you should be able to:

• Describe the security purpose of virtual networks and subnets.
• Apply segmentation and least-privilege principles to cloud network design.
• Explain routing tables, security groups, network access control lists, and firewalls.
• Distinguish public, private, and hybrid connectivity.
• Design secure DNS resolution and administration paths.
• Explain the role and limitations of WAF and DDoS protection.
• Develop a basic defence-in-depth architecture and evaluate its risks.

1. The Cloud Network Security Model

Traditional data-centre networks commonly relied on a perimeter: users entered through a small number of controlled gateways, while internal systems were relatively trusted. Cloud environments are more distributed. Workloads may span regions, accounts, virtual networks, containers, serverless services, and software-as-a-service platforms. Consequently, security must be applied at several layers:

1. Identity layer: determines who or what may administer or use a resource.
2. Network layer: determines which systems can communicate.
3. Workload layer: protects operating systems, containers, databases, and applications.
4. Data layer: protects information through access control, encryption, and governance.
5. Monitoring layer: detects and investigates suspicious activity.

Network controls should implement least privilege: permit only the protocols, ports, sources, destinations, and directions required for a legitimate business function. Network security is not achieved by making everything private; private systems can still be compromised, misconfigured, or abused by an authorised identity.

A useful design principle is defence in depth. For example, an internet-facing application may be protected by a DDoS service, a WAF, a load balancer, a network firewall, workload-level security rules, strong identity controls, and monitoring. Each control addresses different failure modes.

2. Virtual Networks and Addressing

A cloud provider normally supplies an isolated logical network, called a virtual network, virtual private cloud, or equivalent service. The network is assigned an IP address range expressed in CIDR notation. For example, 10.20.0.0/16 represents a block containing 65,536 IPv4 addresses, although cloud platforms reserve some addresses for infrastructure and not all are assignable.

CIDR notation uses a prefix length. In IPv4, the number of addresses in a block is:

Here, N is the total number of IPv4 addresses, and p is the prefix length. The formula assumes a conventional IPv4 CIDR block and counts all addresses, including addresses that a platform may reserve. For 10.20.0.0/16, N = 2^(32−16) = 65,536. A /24 block contains 256 addresses.

Subnetting divides a larger network into smaller ranges. A common design separates:

• Public subnets: contain resources that require a route to an internet gateway, although a public subnet does not automatically make every resource publicly reachable.
• Private application subnets: contain application servers without direct inbound internet routes.
• Private data subnets: contain databases, caches, and internal services.
• Management subnets: contain controlled administrative services or inspection appliances.

Address planning should avoid overlap between cloud networks, on-premises networks, partner networks, and future acquisitions. Overlapping ranges complicate routing and may prevent private connectivity. IPv6 should also be considered where required; security rules must explicitly address IPv6 rather than assuming IPv4 rules protect both protocols.

A subnet is a logical placement and routing boundary, not a complete security boundary. Effective security requires routes, security groups, network ACLs, firewalls, identity controls, and monitoring.

3. Segmentation and Zero-Trust Connectivity

Segmentation limits the effect of compromise. A simple three-tier model places a web tier in front of an application tier and a data tier behind it:

Figure: A three-tier network in which each tier accepts only required traffic from the preceding tier.

Segmentation should be based on communication requirements rather than labels alone. A useful rule matrix identifies source, destination, protocol, port, direction, business purpose, and owner. For example, an application tier may connect to a database on TCP 5432, while the database accepts no inbound traffic from the internet or web tier.

Microsegmentation applies controls at workload or service level rather than only at subnet level. It is valuable when many applications share infrastructure. Zero trust complements segmentation by avoiding implicit trust based on network location. Every request should be evaluated using identity, device or workload context, policy, and, where appropriate, continuous monitoring.

4. Routing and Traffic Paths

A route table maps a destination prefix to a next hop, such as a local network, internet gateway, NAT gateway, transit gateway, virtual appliance, or VPN tunnel. Routing determines where traffic attempts to go; it does not by itself authorise the traffic.

The most specific matching route generally takes precedence. For example, a route to 10.20.5.0/24 is preferred over a broader route to 10.20.0.0/16 for a destination within 10.20.5.0/24. This behaviour is known as longest-prefix matching.

Important routing components include:

• Internet gateway: provides a controlled path between a virtual network and the public internet.
• NAT gateway or proxy: allows private workloads to initiate selected outbound connections without accepting unsolicited inbound connections through that mechanism.
• Transit hub: connects multiple virtual networks and on-premises environments.
• VPN: creates encrypted tunnels over an untrusted network.
• Dedicated private connection: provides a private provider or carrier path, but encryption and access controls may still be necessary.
• Inspection appliance: receives traffic for filtering, logging, or intrusion prevention.

A secure design documents both forward and return paths. Asymmetric routing—where traffic leaves through one path and returns through another—can break stateful firewalls and complicate investigation. Route propagation should be controlled, and administrators should test failover routes rather than assuming they work.

5. Security Groups, Network ACLs, and Firewalls

Cloud platforms commonly provide several related but distinct controls.

A stateful control remembers an established connection. If an outbound connection is permitted, the return traffic is usually permitted automatically. A stateless control evaluates each direction separately; return traffic must be explicitly allowed. The exact behaviour varies by provider, so documentation and testing are essential.

Security groups should normally reference trusted groups or service identities where possible rather than broad IP ranges. Avoid rules such as “allow TCP 0–65535 from 0.0.0.0/0.” Administrative access should use a controlled management path, identity-aware proxy, or bastion arrangement, with multi-factor authentication and logging.

A network firewall is useful for central policy, egress filtering, threat signatures, domain controls, and inspection between zones. However, centralisation can create bottlenecks, single points of failure, and operational complexity. High availability, scaling, and correct routing must be designed.

The default-deny principle is valuable, but it must be implemented carefully. Denying all traffic without understanding dependencies may interrupt critical services. A safe process is to discover dependencies, create narrowly scoped allow rules, test them, monitor rejected traffic, and remove temporary exceptions.

6. Private Connectivity and Hybrid Networks

Private connectivity prevents sensitive services from requiring public internet exposure. Common patterns include:

• Private service endpoints: connect privately to managed cloud services.
• VPC or virtual-network peering: directly connects two networks, usually with limited transitive routing.
• Transit gateway or virtual WAN: provides hub-and-spoke connectivity and central policy.
• Site-to-site VPN: encrypts traffic between cloud and an organisation’s network.
• Dedicated circuits: provide predictable private connectivity, but availability and encryption requirements must be assessed.
• Private service publishing: exposes a service privately to approved consumers without opening the entire network.

Private does not mean trusted. A private endpoint still requires authentication, authorisation, encryption where appropriate, logging, and vulnerability management. Routing between environments should be limited to required prefixes, and shared services should not become unrestricted pathways for lateral movement.

For hybrid systems, administrators should document ownership and failure responsibility. A cloud provider may operate the virtual gateway while the customer operates the on-premises router, firewall, and route advertisements. Redundant tunnels or circuits, health checks, and tested failover procedures are important for availability.

7. DNS Security

The Domain Name System translates names into addresses and supports service discovery. Cloud DNS commonly includes public zones, private zones, forwarding rules, resolvers, and split-horizon DNS.

A public zone publishes records reachable through the internet. A private zone resolves names only within selected networks. Split-horizon DNS can return a private address to internal users and a public address to external users for the same name. This improves routing and reduces unnecessary exposure, but inconsistent records can cause troubleshooting and security problems.

DNS security practices include:

• Restricting who can create or modify zones and records.
• Enabling DNS query logging and monitoring unusual volumes or destinations.
• Using DNSSEC where supported and appropriate for authenticating public DNS responses.
• Protecting resolvers from open-recursion abuse.
• Using private resolution for internal services.
• Preventing sensitive information in hostnames and records.
• Controlling outbound DNS so workloads cannot freely use unauthorised resolvers.

DNS filtering can block known malicious domains, but it is not a substitute for application-layer controls. Attackers may use encrypted DNS, compromised legitimate domains, direct IP connections, or newly registered domains.

8. Web Application Firewalls

A WAF operates at the HTTP or HTTPS layer. It can inspect methods, headers, URLs, parameters, cookies, request bodies, and application patterns. Typical protections address common web risks such as injection, malicious scripts, protocol anomalies, abusive bots, and request-rate abuse.

A WAF may use managed rules, custom rules, positive security models, reputation intelligence, and rate limiting. A negative security model blocks known malicious patterns; a positive security model permits only known-valid request structures. Managed rules are useful for rapid coverage, while custom rules are often required for business-specific behaviour.

WAF limitations include false positives, false negatives, encrypted traffic visibility constraints, application-specific logic, and the inability to repair vulnerable code. WAF logs should be reviewed in detection mode before aggressive blocking. Rules should be tested against normal traffic, APIs, mobile clients, and planned releases.

9. DDoS Protection and Availability

A distributed denial-of-service attack attempts to exhaust bandwidth, connection capacity, protocol resources, or application processing. Attacks may be volumetric, protocol-based, or application-layer. DDoS protection commonly combines upstream traffic absorption, anycast distribution, rate controls, caching, load balancing, autoscaling, and WAF policies.

A useful availability relationship is:

Here, A is steady-state availability, MTBF is mean time between failures, and MTTR is mean time to repair; both time values must use the same units. This formula assumes a simplified repairable system with stable average failure and repair behaviour. It does not model correlated failures, planned maintenance, or complex multi-region dependencies. Reducing recovery time can therefore improve availability, but DDoS resilience also requires sufficient capacity and a tested response process.

DDoS planning should identify critical endpoints, baseline normal traffic, define alert thresholds, confirm provider escalation paths, and test emergency procedures. Rate limiting must avoid blocking legitimate customers, and emergency changes should be authorised and recorded.

10. Monitoring, Logging, and Incident Response

Network security controls are incomplete without evidence. Useful telemetry includes flow logs, firewall decisions, WAF events, DNS queries, load-balancer logs, VPN status, route changes, and administrative activity. Logs should contain reliable timestamps, source and destination context, action, rule identifier, and correlation information where legally and technically feasible.

Monitoring should detect events such as:

• New internet-facing addresses or routes.
• Security rules allowing broad sources or sensitive ports.
• Unexpected cross-segment traffic.
• Large outbound transfers or unusual DNS destinations.
• Repeated WAF blocks or authentication failures.
• Route changes, tunnel failures, and abnormal traffic increases.

Retention and access must reflect legal, contractual, and investigative requirements. Logs may contain IP addresses, identifiers, URLs, or personal data, so access should be restricted and retention should not be indefinite without justification.

An incident process should include preparation, detection, containment, eradication, recovery, and lessons learned. During containment, changing a rule can preserve availability but may destroy forensic evidence or interrupt business services. Decisions should therefore involve security, operations, application owners, and—where necessary—privacy and legal teams.

11. Illustrative Case: Securing a Healthcare Booking Platform

Background

A fictional healthcare provider operates a cloud-based appointment platform. Patients access a web portal, clinicians use an internal application, and appointment data is stored in a managed database. The organisation must protect sensitive personal information and maintain service availability.

Problem

The initial deployment placed web servers and databases in the same network segment. Database administration was performed through public addresses, security rules allowed broad inbound access, and DNS records were managed by several administrators. A traffic spike caused service degradation, while logs were insufficient to determine whether malicious traffic was involved.

Analysis

The main risks were excessive lateral movement, public exposure of management services, weak change control, insufficient application-layer filtering, and limited visibility. Availability risk was also increased because there was no tested DDoS response or failover procedure.

Approach and Solution

The organisation redesigned the architecture into web, application, and data tiers. A managed WAF and DDoS service was placed at the edge, followed by a load balancer. Web workloads accepted HTTPS only from the load balancer. Application workloads accepted only the required service traffic from the web tier. The database accepted connections only from the application tier on its database port.

Database administration moved to a private endpoint accessed through an identity-controlled management path. Public and private DNS zones were separated, DNS changes required approval, and query logging was enabled. Network flow logs, WAF events, firewall logs, and administrative activity were sent to a central monitoring system.

The team used staged rule deployment: observe, test, enforce, and review. It conducted a failover exercise, validated backup connectivity, and created an incident playbook for DDoS and suspected data exfiltration.

Outcome

The redesign reduced public exposure, constrained lateral movement, improved evidence for investigations, and provided a documented response path for traffic attacks. It did not eliminate risk: compromised application credentials could still permit legitimate-looking database queries, and operational mistakes remained possible.

Learning Points

1. Segmentation should reflect actual application flows.
2. Private connectivity reduces exposure but does not replace authentication.
3. WAF and DDoS services address different layers.
4. Logging and tested response procedures are part of network security.
5. Security rules require ownership, review, and lifecycle management.

12. Governance, Ethics, and Contemporary Practice

Network architecture affects privacy, availability, and freedom of access. Excessive monitoring may collect personal information unrelated to security. Organisations should define a legitimate purpose, minimise collected data, protect logs, restrict access, and comply with applicable data-protection and sector requirements.

Network controls should not discriminate against legitimate users or conceal service failures. Automated blocking systems need review mechanisms, especially where false positives could deny access to healthcare, education, financial, or emergency services.

Contemporary cloud practice increasingly uses infrastructure as code, policy as code, software-defined perimeters, service meshes, confidential computing, and automated threat detection. AI-assisted detection can identify traffic anomalies and suggest rules, but it may generate false positives, encode biased assumptions, or recommend overly broad blocking. Human review, change approval, explainability, and rollback are necessary for high-impact decisions.

Best-Practice Checklist

• Plan non-overlapping address ranges before deployment.
• Separate internet-facing, application, data, and management functions.
• Use explicit allow rules and minimise broad network sources.
• Review both forward and return routes.
• Prefer private endpoints for sensitive managed services.
• Protect DNS administration and monitor DNS queries.
• Place WAF and DDoS controls at appropriate boundaries.
• Enable flow, firewall, DNS, WAF, and administrative logging.
• Test failover, incident response, and rule changes.
• Review network policies regularly and remove obsolete exceptions.
• Treat private networks as controlled, not inherently trusted.
• Protect monitoring data as potentially sensitive information.

Chapter Summary

Cloud network security controls how traffic reaches, leaves, and moves within cloud infrastructure. Virtual networks and subnetting provide logical structure, while segmentation limits lateral movement. Routing determines traffic paths but does not authorise communication. Security groups, ACLs, host firewalls, network firewalls, WAFs, and DDoS services operate at different scopes and layers and should be combined through defence in depth.

Private connectivity and private DNS reduce unnecessary public exposure, but private systems still require authentication, authorisation, encryption where appropriate, logging, and monitoring. Secure design depends on least privilege, explicit traffic flows, controlled administration, non-overlapping addressing, tested failure handling, and sound governance. The most effective architecture is one that is technically restrictive, operationally observable, and aligned with business and regulatory responsibilities.

Key Terms

Virtual network: A logically isolated cloud network for workloads and services.

CIDR: A notation that represents an IP network prefix and its address range.

Subnet: A subdivided IP network with associated routing and placement rules.

Segmentation: Dividing a network into zones with controlled communication paths.

Microsegmentation: Applying fine-grained controls to individual workloads or services.

Route table: A set of destination-to-next-hop forwarding rules.

Security group: A provider control that filters traffic for a workload or interface.

Network ACL: A subnet-level traffic filter, often stateless.

Stateful firewall: A firewall that tracks connection state.

NAT gateway: A service allowing selected outbound connections without direct inbound exposure through that path.

Private endpoint: A private connection to a service without requiring public routing.

VPN: An encrypted tunnel across an untrusted or shared network.

DNS: The system that maps names to network addresses and services.

Split-horizon DNS: DNS that returns different answers according to the requester’s network context.

WAF: A web application firewall that inspects HTTP or HTTPS traffic.

DDoS: A distributed denial-of-service attack intended to exhaust resources.

Least privilege: Granting only the access necessary for a stated purpose.

Defence in depth: Using multiple complementary security controls.

Flow log: A record describing network connection metadata and decisions.

Zero trust: A security approach that verifies each request rather than trusting network location.

Review Questions

Short Answer Questions

1. What is the difference between a public subnet and a private subnet?
2. Why should cloud address ranges avoid overlapping with on-premises networks?
3. How does a stateful firewall differ from a stateless filter?
4. What is the main purpose of a WAF?
5. Why is private connectivity not sufficient by itself to establish trust?

Long Answer Questions

1. Explain how a three-tier architecture applies segmentation and least privilege.
2. Compare security groups, network ACLs, network firewalls, and host firewalls.
3. Describe a secure DNS design for an organisation using both public and internal services.
4. Explain how DDoS protection, WAF controls, load balancing, and monitoring complement one another.
5. Discuss the governance and privacy issues associated with network logging.

Analytical / Application Questions

1. A database is reachable from the internet because it has a public route and a broad inbound rule. Propose a sequence of changes to reduce exposure while preserving application access.
2. An organisation connects six cloud networks and two offices through a transit hub. What routing, segmentation, redundancy, and monitoring decisions should be made before production deployment?
3. A WAF begins blocking legitimate mobile-app requests after a new rule is enabled. Analyse possible causes and propose a controlled remediation process.

Multiple Choice Questions with Answers

Question 1

What is the primary security purpose of network segmentation?

A. To eliminate the need for authentication

B. To limit communication and reduce lateral movement

C. To make every workload publicly reachable

D. To replace application patching

Correct Answer: B. To limit communication and reduce lateral movement

Question 2

How many total IPv4 addresses are represented by a /24 CIDR block, before provider reservations?

A. 24

B. 128

C. 256

D. 512

Correct Answer: C. 256

Question 3

Which component determines the next hop for a destination network?

A. Route table

B. WAF rule

C. DNS zone

D. Identity directory

Correct Answer: A. Route table

Question 4

Which control is specifically designed to inspect HTTP requests for application-layer attacks?

A. NAT gateway

B. WAF

C. VPN tunnel

D. Subnet route table

Correct Answer: B. WAF

Question 5

What is a key characteristic of a stateful firewall?

A. It evaluates only DNS records

B. It tracks connection state and commonly permits return traffic for an allowed connection

C. It can operate only on public networks

D. It never records traffic decisions

Correct Answer: B. It tracks connection state and commonly permits return traffic for an allowed connection

Question 6

Which statement about a private endpoint is correct?

A. It removes the need for authorisation

B. It guarantees that a workload is uncompromised

C. It provides private access to a service but still requires security controls

D. It automatically encrypts every application payload in all circumstances

Correct Answer: C. It provides private access to a service but still requires security controls

Question 7

What is split-horizon DNS used for?

A. Returning different DNS answers based on network context

B. Encrypting all database records

C. Blocking every internet connection

D. Replacing route tables

Correct Answer: A. Returning different DNS answers based on network context

Question 8

Which attack attempts to exhaust network, protocol, or application resources using distributed sources?

A. DDoS attack

B. SQL backup

C. DNS caching

D. Subnetting

Correct Answer: A. DDoS attack

Question 9

Using A = MTBF ÷ (MTBF + MTTR), what is availability when MTBF is 99 hours and MTTR is 1 hour?

A. 0.01

B. 0.50

C. 0.99

D. 1.99

Correct Answer: C. 0.99

Question 10

Which practice best supports investigation of unexpected cross-segment traffic?

A. Disabling all logging

B. Using network flow logs and firewall decision logs

C. Allowing all ports temporarily and never reviewing them

D. Publishing internal DNS records publicly

Correct Answer: B. Using network flow logs and firewall decision logs