Network Architecture

Segmentation, boundary protection, and deny-by-default networking.

Covers boundary protection and network-level controls from the NIST SP 800-171 System & Communications Protection (SC) family.

Three tiers, deny by default

The platform uses a three-tier network inside a dedicated VPC:

1. Public tier — only the load balancer, fronted by AWS WAF.
2. Application tier (private) — the web application and API containers. No inbound internet access; only the load balancer can reach them.
3. Data tier (private) — the database and supporting services. Reachable only from the application tier.

Security groups and network ACLs are deny-all by default with explicit allow rules for exactly the flows the architecture requires (load balancer → application → database). There is no path from the internet to the application or data tiers, and no SSH/RDP path to any container.

Boundary protection

• AWS WAF filters all traffic before it reaches the load balancer, using managed rule groups that block common attack patterns (SQL injection, cross-site scripting, known-bad inputs, anonymized/malicious sources) and update automatically as new threats are identified.
• The load balancer is the single managed entry point — all user and API traffic, including any administrative use of the application, comes through it over TLS.
• Calls from the application to AWS services (storage, secrets, keys) use VPC endpoints (private connectivity), keeping internal traffic off the public internet.

Monitoring at the network layer

• VPC Flow Logs record network traffic across all segments.
• Load balancer access logs record all HTTP requests.
• Amazon GuardDuty analyzes flow logs, DNS activity, and API activity for threats and anomalies.

The C3PAO assessor application does not appear in this architecture at all — it runs inside the assessor's own network boundary. Its only network exposure is a local HTTPS port inside that environment; the air-gapped build makes no outbound calls to Foxx Cyber. See Where CUI Lives.