Home / Knowledge hub / Security group
Knowledge hub
Security group
Cloud firewall rules that decide which traffic may reach a server.
What it means
A security group is a virtual firewall attached to cloud resources such as servers and databases. It holds rules that say which traffic is allowed in and out, by protocol, port and source or destination address. The term is used by AWS, and other clouds have close equivalents under other names.
In AWS, security groups only contain allow rules, and traffic that no rule allows is denied. They are also stateful: reply traffic to an allowed request is permitted without a separate rule.
Why it matters
Security groups are often the first and last barrier between the internet and your servers. A rule that opens a database port to everyone, or opens remote administration to the whole world, puts something private in front of every scanner that looks.
Mistakes are easy to make and easy to leave in place. A rule opened for a quick test and never closed can sit for years. Because rules can reference other groups, a change in one place can quietly widen access in another.
How it shows up
You meet them in every cloud setup. Frequent mistakes are inbound rules open to 0.0.0.0/0 on ports for databases, SSH or remote desktop, broad ranges of ports, rules left from testing, and one group shared by many unrelated services.
Allow only what each service needs, from the narrowest source you can, and name groups by purpose. Review rules regularly and alert on changes. Treat it as one layer of defence in depth. CSPM tools can flag open rules, but they cannot say whether the service behind is vulnerable.
Questions people ask
Security group, answered
Is a security group the same as a firewall?
It does the same job for cloud resources: allowing or denying traffic by rule. It is applied to the resource and managed through your cloud account, not a box in a rack.
What does 0.0.0.0/0 mean in a rule?
It means every IPv4 address, in other words the whole internet. That is fine for a public web server on port 443 and rarely right for a database or an admin port.
How is it different from a network ACL?
In AWS, network ACLs work at the subnet level, can both allow and deny, and are not stateful. Security groups work at the resource level, only allow, and are stateful. Many setups use both.
Do security groups protect against application flaws?
No. They control who can reach a port. Once traffic is allowed to your web application, flaws such as SQL injection still work through it.
How do we audit ours?
List all inbound rules open to the internet, ask the owner of each why, close unused ones and narrow the rest. Re-check after every major change, and test from outside that the closed ports stay closed.
Sources
Where this comes from
Related
Terms that sit next to this one
Firewall
A control deciding which traffic is allowed to reach a system.
Virtual private cloud
A private, isolated network space inside a public cloud account.
Cloud misconfiguration
A cloud setting left unsafe, such as open storage or an overly broad permission.
Attack surface
Everything about your application an outsider can touch.
Bastion host
A single hardened server that is the only way in for administrators.
Which ports does the internet see?
We test your application from the outside the way a stranger would, which shows what your rules really let through. Findings carry the request, the response and the evidence. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.