Outbound security implementation with AWS Network Firewall & Route 53
summary
AWS Network Firewall plus Route 53 DNS Firewall enforce outbound controls using managed rule groups (Suricata signatures, Recorded Future and GuardDuty feeds) and deep packet inspection to decode TLS and block suspicious flows. Common exploit indicators are direct-to-IP wget calls and odd ports like port 8765 plus rapid domain resolutions; catching those early prevents full C2 compromise. A pragmatic policy uses alert‑then‑block, generous allowlists atop managed rules, VPC endpoints to cut cost and reduced NAT egress from 455→22 GB/hr.
AI-written summary · about
chapters (11)
- 0:00Intro
- 3:28AWS egress security services
- 5:17Network Firewall top use cases
- 8:07Why are AWS customers spending time on egress security?
- 13:50Typical web app architecture - Ingress & egress
- 18:29Robinhood's egress security journey
- 24:23Spectrum of application behavior
- 28:58Journey timeline
- 30:29What a good starting egress policy might look like
- 35:30Network Firewall top 10 best practices
- 36:48Cost optimization and visibility bonus
related talks
17mStrengthening security with DNS Firewall
44mElevando la postura de seguridad con AWS Network Firewall
50mAWS Well-Architected for network security
51mNetwork inspection design patterns that scale
33mNetwork and application protection on AWS
51mProtect your internet-facing web applications hosted on AWS
27mSecuring Applications and Managing WAFs at a large scale
18mEnhance application security at the edge with AWS