Internet and NAT gateways may be deployed without egress filtering, so that any resource in the network can initiate connections to any destination on the public internet. A compromised resource can then transfer data to external systems or reach command-and-control infrastructure, impacting the confidentiality of data.
Unrestricted Outbound Traffic Enables Data Exfiltration
CCC.VPC.TH08
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CP08 | Connectivity Options - Internet Gateway | The service can route traffic between resources in the virtual network and the public internet through an internet gateway, enabling direct internet access for those resources. |
| CCC.VPC.CP09 | Connectivity Options - NAT Gateways | The service can be configured with a NAT gateway that allows resources in private subnets to initiate connections to the internet without exposing them to inbound internet traffic. |
| CCC.Core.CP23 | Network Access Rules | The service restricts access to child or networked resources based on user-defined network parameters such as IP address, protocol, port, or source. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CN08 | Restrict Outbound Internet Traffic | Ensure that resources can only reach explicitly allowed internet destinations, so that a compromised resource cannot exfiltrate data or reach command-and-control infrastructure. |