Cloud, Kubernetes and Infrastructure Security
Cloud Network Architecture and Segmentation
We review how your cloud networks connect to each other and the internet. We show which networks a compromised server could access.
What it is
In the cloud, networks are easily connected. VPC peering, transit gateways and private endpoints create complex structures over time. Real access is only visible when security rules and route tables are analyzed together. The review maps the network and identifies unexpected access.
Scope
- VPC and VNet structure, peering and transit connections
- Security groups, network security rules and route tables
- Internet-facing services, load balancers and public IP addresses
- Access paths to management interfaces
- VPN and private connections to the on-premises network
- Outbound internet traffic control
The need
When organizations need it
- When production and test environments operate on connected networks.
- When an acquisition or new region connects new networks to existing ones.
- When you segment the cardholder data environment in the cloud. PCI DSS requires this separation to be tested at least annually and after any change.
Method
How we work
-
Network map
We combine the networks, connections and rules of every account and region in one map.
-
Reachability analysis
We determine which services are reachable from the internet and from each network segment.
-
Validation
With your approval, we test critical access paths with real traffic from test servers.
-
Target architecture
We propose a target architecture that separates environments and restricts management access.
Outcome
What you have at the end
You receive a current map of your cloud networks and a list of unexpected access paths. You have a practical target architecture that separates your environments.
Frequently asked questions
Our security rules are already strict. Why is this review necessary?
Each rule may be correct on its own. Peering and routing can combine into unexpected paths. These paths are only visible when you see the complete picture.
We are moving to a zero trust architecture. How does this help?
The map of current access shows which connections to migrate to identity-based control first. You can plan the transition based on this map.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting