Network Security Controls and Network Intrusion

Network security controls form a key line of defense in protecting cardholder data environments from unauthorized access and malicious activity. PCI DSS Requirement 1 mandates the installation and maintenance of network security controls to restrict network access to and from the cardholder data environment (CDE), while Requirement 11.5.1 requires the prevention/detection and response to network intrusions. These requirements are foundational to PCI DSS compliance because network boundaries define the scope of the CDE, and effective network intrusion capabilities enables organizations to identify and respond to security incidents before they result in data compromise. In cloud environments, software-defined networking and managed security services provide opportunities to implement these controls with greater automation, consistency, and scalability. 

Network Security Controls and Network Intrusion within the AWS SRA

The AWS SRA provides foundational guidance for network security controls and intrusion detection that directly supports key elements of PCI DSS:

Use Amazon VPC with security groups and network ACLs to implement network segmentation and restrict access to the CDE. Amazon VPC provides logically isolated environments enabling network security functions and boundary definition, while security groups provide stateful filtering at the resource level and network ACLs provide stateless filtering at the subnet level, creating defense-in-depth network controls. Together, these services support Requirements 1.3 and 1.4 for restricting inbound and outbound traffic between trusted and untrusted networks. You are responsible for configuring security group rules and network ACL rules to permit only necessary traffic to and from the CDE.

Leverage AWS Firewall Manager within the network account to centrally manage security group rules, network ACL rules, and AWS Network Firewall policies across multiple accounts in AWS Organizations. Firewall Manager can identify unused, redundant, or overly permissive security groups and enforce organizational policies that define which security groups are allowed or disallowed, supporting Requirements 1.2.7 and 1.2.8 for semi-annual reviews of network security control rule sets and configurations.

Enable Amazon GuardDuty to manage threat detection by analyzing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs to identify malicious or unauthorized behavior. GuardDuty uses machine learning models, anomaly detection, and integrated threat intelligence to detect threats such as compromised instances, reconnaissance activities, and command-and-control communications, addressing Requirement 11.5.1 for intrusion detection. You are responsible for enabling GuardDuty in all relevant AWS accounts and configuring alerting mechanisms such as Amazon EventBridge rules to notify personnel of suspected compromises.

Integrate VPC Flow Logs with Amazon CloudWatch Logs to capture and analyze network traffic metadata at the VPC, subnet, or network interface level. Flow Logs provide visibility into traffic patterns, source and destination IP addresses, ports, and protocols, supporting both network security control validation and intrusion detection activities (Requirements 1.2.7 and 11.5.1). You can use Amazon CloudWatch Logs Insights or Amazon Athena to query and analyze flow log data for security investigations.

Add Config Rules in AWS Config to continuously monitor network security control configurations and detect changes/drifts from approved network control baselines. Config Rules can validate that security groups do not permit unrestricted access (0.0.0.0/0) on sensitive ports, that network ACLs are configured according to organizational standards, and that VPC configurations align with documented network diagrams, supporting Requirements 1.2.7 and 1.2.8 for configuration reviews.

Deploy AWS Network Firewall in a centralized network account to provide stateful inspection, intrusion prevention, and web filtering at the VPC perimeter. Network Firewall uses the Suricata open-source intrusion prevention engine for stateful inspection and can be configured with domain filtering, intrusion prevention rules, and stateful protocol detection, supporting Requirements 1.3, 1.4, and 11.5.1. AWS manages the underlying infrastructure, while you are responsible for defining firewall policies, rule groups, and logging configurations.

Network Security Controls and Network Intrusion beyond the AWS SRA

Some incremental enhancements may be needed to extend the AWS SRA for alignment with additional PCI DSS requirement elements:  

Automate network diagram generation by deploying Amazon Q CLI, combined with the AWS Diagram MCP server and AWS Documentation MCP server, which automatically incorporating AWS service icons, VPC boundaries, security groups, network segmentation zones (untrusted, DMZ, internal), and data flow paths. This AI-driven, diagram-as-code approach substantially reduces the manual effort traditionally required to create and maintain these PCI-mandated diagrams, supports iterative refinement as environments evolve, and helps ensure diagrams remain current and consistent. By leveraging this tooling, organizations can integrate diagram generation into their CI/CD or compliance workflows, reducing documentation drift and providing audit-ready evidence that demonstrates ongoing compliance with PCI DSS Requirements 1.2.3 and 1.2.4 for maintaining accurate network diagrams and data flow diagrams.

Implement automated data flow documentation by using AWS CloudTrail and VPC Flow Logs as data sources, with Amazon OpenSearch Ingestion pipelines to continuously ingest, transform, and index flow log data into structured data flow indexes. The indexed data documents source, destination, transport protocols, encryption methods, and access controls for each data flow. Leverage OpenSearch Dashboards to visualize network flows in near real-time providing continuous, audit-ready evidence of account data flows supporting Requirement 1.2.4 for accurate data flow diagrams.

Deploy centralized network security control review automation by configuring leveraging AWS Config conformance packs with rules that validate network security control configurations against PCI DSS requirements and . Deploy AWS Security Hub CSPM with the PCI DSS security standard enabled to aggregate findings across accounts. Create Amazon EventBridge rules monitoring for network resource changes and compliance status changes via AWS Config, AWS Security Hub CSPM, and AWS Network Firewall that trigger AWS Lambda functions to generate semi-annual network security control review reports, documenting all security group rules, network ACL rules, and firewall policies with business justifications, supporting Requirements 1.2.7 and 1.2.8.

Enable automated intrusion detection alerting by configuring Amazon GuardDuty findings to publish to Amazon EventBridge, which triggers AWS Lambda functions or Amazon SNS topics to alert security personnel of suspected compromises. Integrate GuardDuty with AWS Security Hub to correlate intrusion detection findings with other security alerts. Configure Amazon CloudWatch alarms to monitor GuardDuty finding counts and severity levels, ensuring personnel are promptly alerted to suspected network intrusions (Requirement 11.5.1).

Implement advanced network traffic inspection by deploying VPC Traffic Mirroring to copy network traffic from critical CDE resources to Amazon EC2 instances running third-party intrusion detection appliances from AWS Marketplace. Alternatively, deploy AWS Network Firewall with intrusion prevention rule groups enabled, configuring Suricata-compatible rules to detect and prevent known attack patterns. Configure firewall logs forward to Amazon S3 and Amazon CloudWatch Logs for analysis, supporting Requirement 11.5.1 for monitoring all traffic at the perimeter and critical points of the CDE.

Deploy network access path analysis by configuring Amazon VPC Network Access Analyzer to continuously analyze network paths and validate that CDE resources are properly segmented from out-of-scope environments. Create AWS Config custom rules that leverage Network Access Analyzer findings to detect when network paths violate segmentation requirements, triggering Amazon EventBridge rules that alert security teams and initiate remediation workflows, supporting Requirements 1.3 and 1.4.