AWS Network Firewall Automated Domain Lists
How AWS Network Firewall automates domain-based security for outgoing traffic: From log analysis to rule generation
Organizations usually place a lot of emphasis on inbound traffic controls, which carefully limit what traffic can enter their network perimeter, in order to control incoming (ingress) and departing (egress) network traffic. However, only inbound security issues are addressed by this method. Operating systems, libraries, and packages provide third-party code that is essential to modern applications. This reliance may lead to possible security flaws. Affected workloads may try to connect to unapproved command and control servers or transmit private information to unapproved online locations if these components are exploited.
Because of this, putting in place robust outbound traffic controls especially using domain-based allowlisting has emerged as a crucial security best practice. Many organizations are switching to domain-based allowlisting instead of permitting unfettered outward access or keeping an ever-expanding denylist of domains with a bad reputation. This strategy lowers potential risk surfaces, limits outgoing communications to expressly trusted domains, and aids in defense against known and unknown threats. However, it has historically been difficult and time-consuming to manually find and manage these allowlists.
Automated domain lists from AWS Network Firewall make it easier to administer outgoing traffic control and provide insight into network traffic patterns. By offering analytics for HTTP and HTTPS network traffic, this functionality aids businesses in comprehending domain usage trends. In order to generate rules according to your network traffic, it also automates the study of firewall logs. This feature helps to improve the efficacy of your firewall rules and raises your security awareness by fusing automation with greater visibility.
An overview of traffic analytics and automated domain lists
With domain-based security, you may regulate network traffic according to the domain names that users and your apps are attempting to access. By concentrating on the destinations your network is attempting to reach rather than merely IP addresses, this method provides a more flexible and user-friendly method of creating firewall rules. However, some customers still find it difficult to configure and manage firewall rules efficiently, particularly in big settings with constantly expanding and changing connected devices, applications, and traffic patterns. Companies may struggle to keep up with these developments, resulting in firewall rules and policies that block lawful traffic or expose the network to dangers.
Let’s examine several use cases and advantages of automated domain lists in addressing these issues:
Detective and preventive security measures
- Domain control via allowlisting: Creating domain allowlists is consistent with the least privilege security approach for network traffic. Better insight into potentially dangerous behaviours is made possible by a least-privilege paradigm, which modifies the scope of what a workload may do over the network from limitless and undefined to scoped-down and well-defined. Organisations can better manage and keep an eye on workload communications by restricting outbound connections to just authorised domains.
- Rule audit and compliance: Domain allowlisting helps comply with GDPR, PCI DSS, HIPAA, and other regulations by identifying allowed domains.
- By creating a baseline for typical domain access patterns, preventive controls also serve as detective controls, facilitating detection. Security teams can more effectively identify workloads exhibiting indications of unauthorised activity when a domain allowlist is in place.
- Support for incident response: During security events, domain reporting allows for the prompt detection of possibly hostile domains by providing the most recent list of workload domains accessed. Teams can use this information to prioritise tasks that may require urgent attention.
Value in operations
- Initial firewall setup and management: Automated allowlisting makes it easier to create baseline firewall rules by analysing current traffic patterns and suggesting domain-based rules. In addition to potentially saving time and skill required for initial firewall deployment and continuing management, this aids organisations in swiftly implementing efficient security policies.
- Application modernisation: Allowlisting helps security keep up with changing architectures by enabling firewall rules to be modified to suit quickly shifting traffic patterns in microservices and containerised environments.
- Cross-environment consistency: Regardless of where apps or data are located, allowlisting makes it possible to create and administer firewall rules consistently across multi-cloud and hybrid environments.
The operation of the automatic domain list feature
Automated domain lists function by examining your HTTP and HTTPS traffic, producing reports on domains that are frequently accessed, and offering a practical means of developing rules based on real-world network traffic patterns. Log in to the AWS Management Console, select the Network Firewall service, and then either work with an existing firewall or build a new one to start using automated domain lists in the AWS Network Firewall.
The best ways to put domain allow lists into practice
For operational success, take into account the following recommendations while implementing domain allowlisting. We advise you to review your own internal security and compliance procedures as well.
Begin by using a generous allowlisting strategy:
- To lower the possibility of inadvertently blocking valid domains, start with more expansive and forgiving allowlist rules rather than a more specialised list.
- To take advantage of its risk surface reduction, concentrate on obtaining a Default Deny policy.
- For trusted domains, such as top-level and second-level domains, establish flexible rules. For example, permit access to subdomains under your registered second-level domain. Or grant access to second-level domains under top-level domains that are trusted by your organisation, like.gov,.edu, or.mil.
- Utilise regex-capable bespoke Suricata rules to effectively manage complex traffic.
- Keep in mind that even a broad allowlist offers more security than none at all.
Make iterative improvements:
- After creating a default deny and generous allowlist, assess the rules to see which ones you might want to start focussing on more. To log the precise domains that a pass rule may be permitting access to, use alert rules before pass rules.
- Adapt logging levels to monitoring needs and domain trust levels.
- Rules should be reviewed and updated in light of evolving requirements and operational insights.
- Instead than trying to make the ruleset extremely rigid, refine the rules in a practical and iterative manner.
Configure reliable logging:
- Turn up the alert logs for your network firewall to keep an eye on traffic trends.
- For log analysis, use programs such as Amazon CloudWatch Logs Contributor Insights.
- Think about establishing proactive notifications for domains that key workloads are unable to access.
- Keep an eye on logs to spot any possible additions or modifications to the allowlist.
Other things to think about:
- The automated domain lists feature gives you insight into your network traffic by reporting on connections you’ve seen once you’ve enabled traffic analysis mode. The domain list report can assist you in determining which domains should be included in your firewall rules, even if it does not differentiate between permitted and prohibited traffic.
- After traffic analysis is enabled, the domain traffic data used to create the list of suggested domains is accessible for the last 30 days. This enables you to optimise your firewall policies by concentrating on the most recent and pertinent network traffic.
- Op-in data collection for automatic domain lists is carried out without regard to the firewall settings or logging setup. The firewall’s overall performance is unaffected by turning on the feature.
In conclusion
You can streamline your firewall management procedure, develop more efficient rules based on real traffic patterns, and maintain a robust security posture with less manual labour when you use AWS Network Firewall automated domain lists. This feature assists you in overcoming typical obstacles including managing security in intricate systems, staying up to date with quickly evolving application landscapes, and complying with regulatory standards.
