Thursday, April 30, 2026

Cohort 3 | Project CloudIgnite Topics: Packet Sniffing, HTTP vs HTTPS, VPN vs Firewall, Network Hardening, AWS Security Services, Amazon Inspector, System Hardening, Cryptography Intro Duration: ~3 hours

Key Takeaways

• Wireshark: HTTPS encrypts captured packets; passwords only sent during login, not every request
• VPN encrypts data in transit but cannot close ports; Firewall controls port access but doesn't encrypt
• AWS security services: Inspector (vulnerability scanning), GuardDuty (continuous threat detection), Shield (DDoS), CloudTrail (audit logging), Trusted Advisor (best practices), Security Hub (centralised dashboard)
• Lab 276: Amazon Inspector found outdated Python library in Lambda; fixed by removing version pin
• System hardening: disable unnecessary services, apply patches, limit admin access, close unused ports
• Authentication vs Authorization: who you are vs what you can do
• Intro to cryptography: Caesar cipher, AES/3DES (symmetric), RSA (asymmetric), hashing

Table of Contents

1. Packet Sniffing & Wireshark
2. HTTP vs HTTPS
3. VPN vs Firewall – Key Distinctions
4. VPC Subnets – Public vs Private
5. Network Hardening – Architecture
6. AWS Firewall Tools
7. Security Groups vs NACLs
8. Intrusion Prevention System (IPS)
9. Principle of Least Privilege
10. Lab 276 – Amazon Inspector (Hands-On)
11. System Hardening
12. Authentication vs Authorization
13. AWS Security Services Summary
14. Introduction to Cryptography
15. Knowledge Check Answers
16. CLF-C02 Exam Relevance

1. Packet Sniffing & Wireshark

• Wireshark captures all packets on a network and displays their contents.
• Captured packets are shown as hexadecimal/byte data in the lower panel.
• If traffic uses HTTPS, the payload is encrypted — you see ciphertext, not readable data.
• To decrypt, you need both the encryption key and the algorithm used — practically infeasible without those.
• Even if a packet is captured, passwords are only transmitted during login events, not on every request (subsequent requests use session/authentication tokens).

Key takeaway: Packet sniffing is not a guaranteed way to steal credentials. HTTPS makes interception ineffective.

2. HTTP vs HTTPS

• HTTP is dangerous especially when a site requests payment or login credentials.
• HTTPS encrypts data end-to-end — even if packets are captured, they cannot be read without the key.
• Demo planned (Saturday): Instructor will set up a local HTTP server and demonstrate live packet capture.

3. VPN vs Firewall – Key Distinctions

• Using VPN on public Wi-Fi does not prevent others on the same network from discovering your IP address.
• To close ports, you must use a firewall, not a VPN.
• Loopback IP (127.0.0.1): Traffic to this address stays inside your own machine — no one on the network can see it.

4. VPC Subnets – Public vs Private

Public Subnet

• Hosts resources that need to be accessible from the internet (e.g., web servers).
• Common open ports:
  • Port 80 – HTTP
  • Port 443 – HTTPS
  • Port 22 – SSH

Private Subnet

• Hosts internal/sensitive resources (e.g., databases, storage).
• Only accessible from within the VPC, not from the internet.
• Still requires specific ports open for inter-service communication (e.g., database ports like 5432 for PostgreSQL, 3306 for MySQL).
• Network hardening is less critical here because no direct internet access exists.

Rule of thumb: Web server → public subnet. Database/storage → private subnet.

5. Network Hardening – Architecture

Firewall Best Practices

• Default-deny policy: Block ALL traffic by default, then explicitly allow only what is needed.
• Place firewalls as close to the traffic source as possible.
• Use multiple layers: network firewall + application firewall.

Network Zones

Network Segmentation

• Divide the network into multiple subnets (public/private).
• If one subnet is compromised, others remain protected.
• Apply different security rules to different segments.
• Does not expand IP address ranges — it splits the existing network.

Network Discovery Countermeasures

1. Monitor and log all incoming/outgoing traffic.
2. Watch for unknown IP addresses and unusual activity.
3. Monitor port scan attempts.
4. Restrict network discovery protocols (e.g., disable ICMP/ping where not needed).
5. Limit remote administrative access.

6. AWS Firewall Tools

AWS Network Firewall

• Filters inbound and outgoing traffic at the VPC level.
• Similar in concept to NACL but more feature-rich.
• Supports stateful/stateless rules.

Network Access Control List (NACL)

• Subnet-level firewall.
• Stateless: Inbound and outbound rules must be configured separately.
• Operates on subnets, not individual instances.

7. Security Groups vs NACLs

Stateful vs Stateless Explained

• Stateful (Security Groups): If inbound traffic is allowed, the return outbound traffic is automatically allowed.
• Stateless (NACLs): Inbound and outbound rules are independent — you must configure both explicitly.

Multi-Layer Security

Internet → NACL (subnet-level) → Security Group (instance-level) → EC2 Instance

Two layers of firewall protection for every instance.

8. Intrusion Prevention System (IPS)

• Sits after the firewall in the traffic flow.
• Monitors traffic to and from your server for anomalies.
• Anomaly detection: Flags traffic that does not match expected patterns (e.g., HTTP request on an HTTPS-only server).
• Signature detection: Looks for known malicious patterns in packet data.

9. Principle of Least Privilege

• Only grant the minimum permissions required for a user/role to do their job.
• Ask three questions when granting access:
  1. Who is permitted to have this access?
  2. How will the device/resource be accessed? (SSH, RDP, Console)
  3. Where is access coming from? (specific network, geolocation)

Example:

• A software tester does not need EC2 instance access → don't grant it.
• A developer does need EC2 access → grant it explicitly.

10. Lab 276 – Amazon Inspector (Hands-On)

What was done

1. Opened Amazon Inspector in AWS Management Console.
2. Activated Inspector on the account (free 15-day trial available).
3. Inspector scanned Lambda functions in the account.
4. Found a medium severity finding: Lambda function using outdated Python library requests==2.20.

Fix Applied

1. Navigated to the affected Lambda function (GET request).
2. Opened requirements.txt in the code editor.
3. Changed requests==2.20 → requests (removes version pin → always uses latest stable).
4. Clicked Deploy.
5. Refreshed Inspector findings → all findings cleared.

Key Concepts

• Amazon Inspector detects vulnerabilities; it does not fix them automatically.
• Findings are rated by severity: Low / Medium / High — High requires immediate action.
• requirements.txt is a Python dependency file (equivalent of package.json for Node/React).
• If a version is not pinned, the latest stable version is used by default.

11. System Hardening

Definition

Securing computing systems (EC2 instances, databases, desktops, mobile devices) to reduce their attack surface.

Important: By default, systems are NOT hardened — many background services run automatically.

Security Lifecycle

Prevention → Detection → Response → Analysis → (back to) Prevention

How to Harden a System

1. Disable unnecessary services — use top, ps, or netstat to identify running processes.
2. Check startup/auto-start applications — remove anything unnecessary from auto-start.
3. Apply patches and updates regularly — fixes known security weaknesses.
4. Limit administrative access — follow Principle of Least Privilege.
5. Close unnecessary ports — use firewall rules.
6. Use encryption — encrypt data at rest and in transit.
7. Install antivirus and firewall (for client systems).

Security Baseline

• A defined standard/policy that your system must meet.
• Example: "If a system is idle, it must display a welcome message." If it doesn't → investigate.

Systems That Can Be Hardened

• Desktops
• Servers
• Mobile phones
• Applications

Patching

• A patch fixes a discovered weakness in software or OS.
• Always apply patches when released (e.g., Windows Update, library updates).
• Patches can be OS-level or application-level.

Client Hardening Recommendations

• Run antivirus and firewall.
• Run fewer/necessary applications only.
• Check and clean auto-start programs.
• Apply updates when released.

Server Hardening Recommendations

• Restrict physical access (biometrics, CCTV).
• Use dedicated roles.
• Secure file systems with permissions.
• Use encryption at rest.
• Set up alerts.
• Apply updates.
• Limit administrative access.

12. Authentication vs Authorization

• Authentication = identity check (valid user or not?).
• Authorization = permission check (can this user access this resource?).
• Being authenticated does not automatically grant authorization to all resources.

13. AWS Security Services Summary

GuardDuty vs Inspector

• Inspector: You initiate the scan; point-in-time assessment.
• GuardDuty: Always-on; continuously monitors your environment like a security guard.

AWS Shield Tiers

• Standard: Basic DDoS protection; free (or very low cost).
• Advanced: Enhanced protection; costly.

14. Introduction to Cryptography

(Preview for next topic: Data Security)

• Data Security will cover: cryptography, encryption, decryption, hashing.
• Common algorithms mentioned:
  • Caesar Cipher – simplest; easy to implement and easy to break (substitution cipher).
  • AES / 3DES – symmetric encryption; more advanced.
  • RSA – asymmetric encryption; relies on large number factorization (complex).
  • Base64 – encoding (not true encryption).
  • Hashing – one-way; part of cryptography (e.g., SHA family).
• Symmetric = same key to encrypt and decrypt.
• Asymmetric = different keys (public/private).

Full coverage of Data Security is scheduled for Monday.

15. Knowledge Check Answers

CLF-C02 Exam Relevance

The following topics from this lecture map directly to the AWS Certified Cloud Practitioner (CLF-C02) exam objectives:

Domain 2: Security and Compliance (≈30% of exam)

🔑 High-Priority Items for CLF-C02

Memorize the difference between these four services — they are frequently tested:

• Trusted Advisor → Best practice recommendations
• Inspector → Vulnerability scanning (EC2, Lambda)
• GuardDuty → Continuous threat detection
• Shield → DDoS protection
• CloudTrail → Audit logging of all API activity

Notes compiled from lecture — April 30, 2026. Next session: Saturday (Lab 267 demo + labs), Monday (Lab 277 + Data Security).