SOC 2 Network Security Controls: Firewalls and Segmentation

Network Security in SOC 2

Network security controls prevent unauthorized network access to systems and data, detect network-based attacks, and limit lateral movement in the event of a breach. They map to CC6.1 (access controls), CC6.6 (information asset protection), and CC7.2 (anomaly detection).

For cloud-native SaaS companies, "network security" primarily means AWS VPC configuration (covered in the VPC Security article) plus corporate network controls for the office environment and remote access.

Network Segmentation

Network segmentation separates your network into zones with controlled traffic flows between them. For SOC 2, the key segments are: production (AWS production VPC), development (AWS dev/staging VPC), and corporate (office network and VPN). These should have no direct routing between them — all communication should be through authenticated, authorized channels.

Separate production and non-production AWS environments into different AWS accounts with no VPC peering between them. This prevents a compromised development environment from accessing production. Use AWS Organizations with separate OUs for production and non-production accounts, with SCPs that enforce the separation.

For the office corporate network: implement 802.1X authentication for wired connections, separate guest Wi-Fi from corporate Wi-Fi on a VLAN with internet-only access, and ensure production systems are not accessible from the corporate network without VPN/ZTNA.

Firewall Configuration Best Practices

For cloud environments, security groups and NACLs act as firewalls (see VPC Security article). For office environments, configure a physical or virtual firewall: deny all inbound from the internet by default, allow only specific outbound traffic needed for business operations (HTTPS, DNS, email), and log all traffic for review.

Conduct quarterly firewall rule reviews for CC6.3 access review compliance. Review every rule — verify it is still needed, still accurate, and doesn't have an overly broad source. Remove or tighten rules that fail review. Document the review results.

Use Infrastructure as Code for firewall rules to maintain version history and change review. Terraform or AWS CDK for security groups, and Palo Alto Panorama or equivalent for physical firewalls. Rule changes should go through the same change management process (CC8) as other infrastructure changes.

Intrusion Detection and Prevention

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) monitor network traffic for attack patterns and can block malicious traffic. For AWS workloads: AWS Network Firewall with Suricata rules provides IPS capability. AWS GuardDuty analyzes VPC Flow Logs for network-level anomalies.

For office networks: cloud-delivered security platforms like Cisco Umbrella or Cloudflare Gateway provide DNS-based security and threat intelligence, blocking connections to known malicious domains from the corporate network. These are lightweight controls that add significant detection coverage.

Configure IDS/IPS alerting to route to your incident response process — detections should be actionable, not just logged. Document the detection rules in use and the response procedures for each major rule category.

Remote Access: VPN and Zero Trust

Remote employees and contractors need secure access to internal resources. For SOC 2, remote access must require authentication, use encryption, and be logged. Options: (1) VPN (OpenVPN, WireGuard, AWS Client VPN) — traditional approach, connects users to the corporate network with full network access. (2) Zero Trust Network Access (ZTNA) — modern approach, grants access to specific applications based on identity and device posture, without network-level access.

ZTNA tools (Cloudflare Access, Zscaler Private Access, Tailscale, Teleport) are preferred for SOC 2 because they enforce least-privilege application access (CC6.1), integrate with your IdP for MFA (CC6.2), and log all access sessions (CC7.2) without the risk of full network compromise from a single VPN credential leak.

Network Security Evidence

(1) Network architecture diagram showing production, development, and corporate network segmentation. (2) Firewall rule sets for key security groups and NACLs. (3) Quarterly firewall rule review records. (4) AWS Network Firewall policy configuration (if deployed). (5) GuardDuty and VPC Flow Logs configuration demonstrating network-level monitoring. (6) VPN or ZTNA access logs showing authenticated remote access. (7) Remote access policy document.