Cybersecurity glossary
What is a Security Group?
Learn what a cloud security group is, how stateful allow rules attach to ENIs and instances, and how 0.0.0.0/0 on management ports becomes a standing incident.
Definition
A security group is a cloud virtual firewall attached to network interfaces or instances: it allows specified ingress and egress traffic (usually stateful) and implicitly denies the rest, acting as the first packet filter in front of VMs, load balancers, and many managed services.
Why security groups matter
In a VPC, routing can make a database reachable from the internet the moment it has a public IP and an inbound rule. Security groups are the cloud’s default way to say “only these peers, these ports.”
When the group is 0.0.0.0/0 on 22, 3389, 5432, or 6379, scanners find it within minutes. The vulnerability is not a CVE—it is an allowlist that named the entire internet.
How a packet meets a security group
The NIC has one or more groups
Rules from attached groups are unioned. One overly open group undoes three tight ones.
Inbound rules are evaluated
Source (CIDR or another group), protocol, and port must match an allow. There is no numbered deny list in classic SGs.
State is tracked
Accepted connections get return traffic without a separate outbound rule for that flow.
Outbound rules apply to new egress
Default egress is often allow-all. Restrict it when workloads should not call the world or metadata-adjacent ranges.
Unmatched traffic is dropped
No hit means deny. Logging (flow logs, firewall logs) is how you see the drops and the surprises.
Rules that cause incidents
Admin ports to the world
SSH, RDP, WinRM, and cloud serial consoles exposed on 0.0.0.0/0.
Data stores on public IPs
Postgres, MySQL, Mongo, Redis, Elasticsearch with a convenience CIDR.
Copied production groups
A sandbox rule that allowed a contractor /32 is cloned into prod as /0.
Unused attached groups
An old “temporary debug” group still associated with the launch template.
Security group versus nearby network controls
| Control | Attaches to | Use for |
|---|---|---|
| Security group | ENI / instance / many managed services | Stateful allowlist per workload |
| Network ACL | Subnet | Coarse, stateless subnet guardrails |
| Kubernetes NetworkPolicy | Pods via CNI | East-west allowlists inside the cluster |
| WAF / identity-aware proxy | HTTP entry | Application-layer and identity checks SGs cannot do |
Security group checklist
- Default deny inbound; never start from an allow-all group and subtract later.
- Reference peer security groups for app-to-data paths instead of wide VPC CIDRs.
- Keep SSH/RDP off the internet; use a bastion, VPN, or identity-aware access.
- Put databases and caches in private subnets with no public IP and no 0.0.0.0/0.
- Restrict egress where workloads have no reason to call the public internet.
- Version groups in IaC; alert CSPM on new 0.0.0.0/0 or ::/0 for sensitive ports.
- Detach and delete unused groups so launch templates cannot resurrect them.
- Remember union semantics: one sloppy extra group on the NIC opens the hole.
The practical takeaway
A security group is a stateful allowlist on a cloud network interface. It is simple, powerful, and unforgiving of 0.0.0.0/0 on the wrong port.
Write groups in IaC, peer them to other groups rather than the internet, and keep admin and data ports private. Packet filters do not replace IAM or application auth—but they decide who is allowed to try.
Related security terms
Kubernetes Network Policy
Pod-level allowlists inside the cluster; security groups sit at the VPC/NIC layer.
Cloud Misconfiguration
World-open SSH, RDP, and database ports are classic security-group findings.
Cloud Security Posture Management (CSPM)
Detects 0.0.0.0/0 and unused overly permissive groups across accounts.
Attack Surface
Every open port on a public IP is reachable attack surface.
Infrastructure as Code (IaC)
Security groups should be declared, reviewed, and default-deny in code.
Frequently asked questions
What is a security group in simple terms?
It is a named allowlist of who may talk to a VM or network interface, and on which ports. If a flow is not allowed, the cloud drops it before the operating system sees it.
How is a security group different from a NACL?
Security groups are stateful and attach to instances or ENIs. Network ACLs are typically stateless, subnet-scoped, and evaluated in numbered order. Use both: NACLs as a coarse subnet guardrail, groups as per-workload rules.
What does stateful mean here?
If you allow inbound 443, the return packets are allowed automatically. You do not write a matching outbound ephemeral-port rule for that connection.
Is 0.0.0.0/0 always wrong?
It is expected on a public HTTPS load balancer. It is wrong on SSH, RDP, databases, Redis, and Kubernetes API endpoints. Scope admin ports to bastions, VPN, or identity-aware proxies.
Do security groups replace host firewalls?
No. They filter at the virtual NIC. Host firewalls, application TLS, and IAM still matter if a neighbor in the VPC is compromised or a rule is too wide.
Can Kubernetes NetworkPolicy replace security groups?
No. NetworkPolicy does not control traffic to the node’s public IP, the control plane, or managed databases outside the CNI. Layers stack.
How should rules reference peers?
Prefer another security group ID as the source (app tier to db tier) over CIDR ranges that drift when autoscaling changes IPs.
References
Explore authoritative guidance and frameworks related to security group.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.