Network Security and Perimeter Architect

Wrote docs/architecture/network-security-architect/00-overview/network-security-architect-overview.md. Complete network security architecture specification establishing zero-trust eBPF microsegmentation, centralized Suricata IDS/IPS inspection, AWS Shield DDoS defense, and egress domain allowlists.

---

skill: network-security-architect

Network Security Architecture: FinTech Banking Platform [NETSEC-FIN-001]

Summary

This specification establishes the enterprise network security architecture, perimeter defense, zero-trust microsegmentation, and deep packet inspection framework for the FinTech Banking Platform under run ID bank-netsec-arch-001. It protects 65 Kubernetes clusters and 52,000 peak requests/second across dual AWS regions (us-east-1 primary, us-west-2 disaster recovery). It decisively eliminates the lateral threat propagation and uninspected egress vectors demonstrated in incident SEC-4931 (where an unsegmented container breach allowed lateral port scanning across payment subnets). The architecture enforces kernel-level eBPF microsegmentation via Cilium with a mandatory

default-deny posture, centralized East-West and North-South Layer-7 traffic inspection via AWS Network Firewall running Suricata IPS rule groups, automated DDoS mitigation through AWS Shield Advanced, and strict outbound SNI domain allowlisting.

Detailed Description

Relying on perimeter-only security and broad internal CIDR firewall rules (10.0.0.0/8 Allow) leaves internal cloud networks completely flat. Once an adversary compromises an edge web container, they can execute network discovery, port scans, and unconstrained lateral pivots to adjacent database clusters. Zero-trust network security enforces granular identity-aware microsegmentation at the container socket layer and forces all cross-zone traffic through stateful inspection appliances.

Internet Ingress (52,000 req/sec)
                  │
                  ▼
[ Edge Perimeter: AWS Shield Advanced & AWS WAF ]
  ├── Layer-3/4 DDoS Mitigation (Syn-flood, UDP amplification)
  └── Layer-7 Managed WAF Rules (SQLi, XSS, Bad Bot Rate Limiting)
                  │
                  ▼ (AWS Transit Gateway Inspection Spoke)
[ Central Inspection VPC: AWS Network Firewall ]
  ├── Stateful Suricata Engine (Threat Signatures & Behavioral IPS)
  └── Egress Domain Whitelist Filter (Blocks non-whitelisted SNI)
                  │
                  ▼ (mTLS Encrypted Wire)
[ Kubernetes Cluster: Cilium eBPF Microsegmentation ]
  ├── Ingress Enforcement: Default-Deny East-West Policy
  ├── Layer-7 API Rules: Whitelists specific HTTP methods and paths
  └── Socket-Level Policy: Blocks unauthorized lateral TCP ports

Criteria and weights

Comparison

Result

Option C is selected. Cilium eBPF enforces zero-trust socket microsegmentation inside clusters; AWS Network Firewall inspects all cross-boundary transit traffic.

---

Required Mechanisms

1. Zero-Trust eBPF Microsegmentation (Cilium) [MC-MS-01]

Default-Deny Policy: Every namespace in the cluster enforces a baseline CiliumNetworkPolicy rejecting all ingress and egress traffic by default:

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: default-deny-all
  namespace: payments-prod
spec:
  endpointSelector: {}
  ingress: []
  egress: []

Explicit Whitelisting: Pods explicitly declare permitted ingress peers via Kubernetes labels and permitted Layer-7 HTTP paths (/v1/payments/charge only).

Socket Enforcement: Policies compile to BPF bytecode executed directly in the Linux kernel socket layer, bypassing slow iptables chains.

2. Centralized Egress Inspection & Domain Allowlists [MC-EI-01]

• All outbound traffic from spoke VPCs routes through the Central Inspection VPC via Transit Gateway.
• AWS Network Firewall Suricata Rules:
  • Stateful domain allowlist: Permits outbound HTTPS exclusively to approved endpoints:
    [".visa.com", ".mastercard.com", ".swift.com", ".bank.internal"].
  • Blocks all non-TLS port 80/TCP traffic and non-whitelisted outbound IPs.
  • Active IPS signature matching drops known malware command-and-control (C2) signatures in real time.

3. Edge DDoS & Web Application Firewall (AWS Shield) [MC-DD-01]

• Perimeter Defense:
  • AWS Shield Advanced integrated with AWS WAF on external Network Load Balancers.
  • Automatic Layer-3/4 packet rate-limiting absorbs volumetric SYN/UDP reflection floods at AWS edge PoPs.
  • WAF token-bucket rule blocks client IP addresses generating > 1,000 requests per 5-minute window.

4. Automated Threat Quarantine Isolation [MC-AQ-01]

• When AWS GuardDuty or Suricata flags an active compromised pod IP:
  1. Automated EventBridge rule invokes Lambda quarantine-network-isolate.
  2. Applies CiliumNetworkPolicy dynamically labeling the target pod quarantined: true, dropping 100% of its ingress and egress traffic within

10 seconds.
3. Preserves container memory for forensic analysis while eliminating lateral threat risk.

---

Invariants and Contracts

Mandatory Default-Deny Microsegmentation [INV-NETSEC-01]
  Kubernetes production namespaces must enforce a default-deny CiliumNetworkPolicy.
  Deploying workloads in unsegmented namespaces without explicit network policies is prohibited.

Centralized Egress Domain Filtering [INV-NETSEC-02]
  Workloads must not initiate outbound connections to arbitrary public IP addresses.
  All outbound internet requests must resolve to explicit FQDN allowlists enforced by the firewall.

Ten-Second Threat Quarantine Ceiling [INV-NETSEC-03]
  Detected active lateral scanning or C2 beaconing must result in automated pod socket isolation
  within 10 seconds of detection alert generation.

Explicit Unknowns

• Suricata deep packet inspection CPU overhead during sustained 52,000 req/sec payment payload spikes (G-1).
• Cilium eBPF map memory saturation when maintaining 100,000 active concurrent connection states per node (G-2).

Traceability

Verification

No validator was supplied, so no command was run.

Reviewer self-check against network security standards:

• Zero-Trust Hardening: PASS. eBPF socket-level default-deny prevents lateral port scanning.
• Egress Rigor: PASS. Centralized AWS Network Firewall inspects outbound SNI domains against allowlists.
• DDoS Mitigation: PASS. AWS Shield Advanced and WAF token buckets absorb volumetric floods.
• Markdown Hygiene: PASS. Native Markdown syntax strictly adheres to rule_markdown.md.

Open Decisions

• DEC-NETSEC-01: David O'Reilly to determine whether TLS forward proxy decryption should be deployed in the central inspection VPC for outbound partner API payloads (Owner: David O'Reilly).

Next steps

1. Marcus Vance provisions AWS Network Firewall rule groups in the Central Inspection VPC.
2. Platform team deploys Cilium CNI with eBPF default-deny network policies across all 65 clusters.
3. Conduct staging penetration test executing lateral port scanning from a test pod to verify immediate eBPF drop.