network-security

name	Network Security
description	Cloud-native network protection, zero-trust architecture, and AWS VPC security
license	Apache-2.0
version	1.0
author	Hack23 AB
tags	["network-security","zero-trust","aws-vpc"]
category	security
frameworks	["ISO 27001:2022","NIST CSF 2.0","CIS Controls v8.1"]
related_policies	["Network_Security_Policy.md"]

🌐 Network Security Skill

🎯 Purpose

Enforce cloud-native network security with zero-trust architecture, based on Network Security Policy.

Key Principle: "The perimeter is dead. Long live zero-trust."

📚 Scope

• ☁️ Cloud-Native Protection (AWS-native services)
• 🔐 Zero-Trust Architecture (never trust, always verify)
• 🛡️ Network Segmentation (VPC isolation, security groups)
• 🔑 VPN Requirements (secure remote access)
• 🔥 Firewall Rules (AWS WAF, security groups, NACLs)

⚙️ Security Rules

MUST Requirements

aws_vpc_architecture:
  network_design:
    multi_tier: [public_subnets, private_subnets, isolated_subnets]
    availability_zones: minimum_2_for_ha
    security_groups: default_deny_least_privilege
    nacls: additional_subnet_protection
  
zero_trust_controls:
  identity: iam_roles_with_mfa
  segmentation: micro_segmentation_per_workload
  encryption: tls_1_3_preferred_vpn_for_admin
  monitoring: cloudtrail_guardduty_flowlogs

aws_waf:
  managed_rules: [owasp_top_10, known_bad_inputs, ip_reputation]
  custom_rules: [rate_limiting, geo_blocking]
  logging: s3_with_90_day_retention

MUST NOT Prohibitions

prohibited:
  -