The Secret Life of Azure: The Subnet That Trusted Too Easily
.jpeg)
Bringing your security vision to life through intentional network segmentation and boundary control.
Arc 2 — Resource Security & Governance
The rain had returned, tapping softly against the library glass. Margaret was looking at the diagram of the Virtual Network she had drawn earlier, adding dashed lines to divide the large rectangle into three smaller sections.
"Timothy," Margaret said, her voice gentle, "last time we spoke about the individual rules of the NSG. Today, we must decide where those rules should stand to be most effective. Should they stand at the door of every single room, or at the main entrance to the hallway?"
Timothy looked at the dashed lines. "You are talking about the difference between applying an NSG to a Network Interface (NIC) and applying it to a Subnet".
"Exactly," Margaret replied. "While Azure allows you to attach an NSG to either, or even both, the way we choose to segment our network—our subnets—determines how easily data can move laterally once it is inside".
The Trust Within the Subnet
Margaret pointed to the first dashed section, which she labeled Subnet A. Inside, she drew two small boxes.
"In many architectures, resources within the same subnet trust each other too easily," she explained. "A critical point to remember is that a subnet-level NSG only filters traffic crossing the subnet boundary; it does not filter traffic moving between two resources inside the same subnet".
Timothy frowned slightly as he processed this. "So, if I only apply my security rules at the Subnet level, and one machine in that subnet is compromised, it can communicate with every other machine in that same section without any interference from the NSG?"
"That is the risk of a 'flat' network," Margaret said. "Unless you have applied an NSG specifically to the individual Network Interfaces, the internal traffic remains unfiltered".
The Power of Segmentation
Margaret began labeling the other sections:
Web-Subnet
App-Subnet
Data-Subnet
"This is why we segment," she said. "By placing our web servers in one subnet and our databases in another, we force every single piece of traffic to pass through the Subnet-level NSG as it moves from one area to the next. We create boundaries where trust must be verified".
Timothy nodded. "It makes the network much easier to manage. Instead of writing fifty identical rules for fifty individual machines, I write one set of rules for the entire subnet".
"Precisely," Margaret agreed. "It is about balance. We use Subnet NSGs for broad, consistent governance, and we use NIC-level NSGs only when a specific resource needs an extra layer of unique protection".
The Direction of Flow
Margaret drew an arrow starting from the Web-Subnet, passing through a dashed line, and ending at the Data-Subnet.
"Remember our discussion on priority," she reminded him. "When traffic moves between subnets, it is evaluated by the Outbound rules of the source subnet and then the Inbound rules of the destination subnet. To be successful, the traffic must be allowed twice".
Putting It into Practice
Timothy looked at the divided diagram. "So, a secure network isn't just about having strong rules; it's about building a structure where those rules are forced to act. We shouldn't trust a subnet to be a safe zone; we should treat every boundary as a checkpoint".
"Well said, Timothy," Margaret said warmly. "By keeping our subnets small and specific—and by ensuring an NSG is applied to every subnet—we turn a large, open space into a series of secure, intentional zones".
Key Concepts
- Subnet-level NSG: A Network Security Group applied to an entire subnet, filtering traffic for all resources crossing that boundary.
- NIC-level NSG: An NSG applied to an individual Network Interface, allowing for granular, resource-specific filtering between machines in the same subnet.
- Lateral Movement: The process by which an attacker moves from one compromised resource to another within the same network environment.
- Micro-segmentation: The practice of dividing a network into small, isolated sections to reduce the attack surface and limit trust.
- Evaluation Order: For Inbound traffic, the Subnet NSG is processed first, followed by the NIC NSG. For Outbound traffic, the NIC NSG is processed first, followed by the Subnet NSG.
Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.
Comments
Post a Comment