network-security
Network Security
The default state of most cloud networks is far too permissive: a security group that allows all outbound traffic, a VPC where every subnet can reach every other subnet, a database reachable from anywhere inside the perimeter because nobody restricted it after launch. That permissiveness isn't a deliberate decision, it's just what happens when nobody actively restricts it — and every unrestricted path is one more route an attacker can use after a single compromised workload.
Reduce what's reachable before worrying about detecting what happens on the paths that remain. A network where nothing unnecessary can talk to anything else contains a breach by construction, without needing to detect it first.
The traffic you never allowed is traffic you never have to defend.