Networking / VPC / Controls / DEV
Restrict Outbound Internet Traffic
CCC.VPC.CN08 · Networking
Ensure that resources can only reach explicitly allowed internet destinations, so that a compromised resource cannot exfiltrate data or reach command-and-control infrastructure.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP08 | Connectivity Options - Internet Gateway | The service can route traffic between resources in the virtual network and the public internet through an internet gateway, enabling direct internet access for those resources. |
| CCC.VPC.CP09 | Connectivity Options - NAT Gateways | The service can be configured with a NAT gateway that allows resources in private subnets to initiate connections to the internet without exposing them to inbound internet traffic. |
| CCC.Core.CP23 | Network Access Rules | The service restricts access to child or networked resources based on user-defined network parameters such as IP address, protocol, port, or source. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH08 | Unrestricted Outbound Traffic Enables Data Exfiltration | Internet and NAT gateways may be deployed without egress filtering, so that any resource in the network can initiate connections to any destination on the public internet. A compromised resource can then transfer data to external systems or reach command-and-control infrastructure, impacting the confidentiality of data. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN08.AR01 | When a resource initiates an outbound connection to the public internet through an internet or NAT gateway, the service MUST deny the connection unless the destination is explicitly allowed by a network access rule. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | SC-7 | |
| NIST_800_53 | AC-4 | |