Key takeaway
Review traffic paths, resource owners and who reaches each app from which device. A “private subnet” label does not prove security; test routes and controls.
What a VPC provides
A VPC is a logically isolated network space inside a public cloud. You choose address ranges and subnets, then configure route tables and network filters. Provider isolation does not replace workload network design: allow and restrict traffic using the controls of the specific provider.
Address ranges and subnets
Plan IP ranges first; place application, data and management tiers in separate subnets when useful. Check for address overlap before connecting hybrid networks.
Routes and connectivity
Review each subnet’s route table, paths through an internet gateway or NAT, and VPN or dedicated private connections. Lack of a public IP does not mean every outbound path is closed.
Traffic rules and logs
Allow inbound and outbound traffic only from required sources, to required destinations and on required ports and protocols. Review rule changes and send flow and security logs to an accountable team.
Choose public or private cloud
Public versus private cloud is not a choice between “secure” and “insecure.” Base the decision on workload needs, control requirements, team capability, total operating cost and connectivity. More control in a private environment also brings more operational responsibility.
| Consideration | Public cloud | Private cloud |
|---|---|---|
| Infrastructure | Provider’s shared physical resources with logical customer isolation. | Resources dedicated to one organization; may be hosted in-house or by a provider. |
| Operations | The provider operates the underlying infrastructure; the customer operates services and configuration. | Operational duties depend on hosting; an in-house private cloud may need more internal staffing. |
| Check | Data location, identity, service configuration and provider access. | Total cost, resilience, maintenance, upgrades and recovery capability. |
A sample three-tier VPC layout
In a common application layout, public traffic reaches a load balancer, passes to application servers under limited rules, and the database accepts connections only from the application tier. This is a design pattern; define public and private subnets by the routing and address behavior of the specific cloud.
Create an entry tier
Place a load balancer or gateway that accepts only required internet traffic; do not expose management ports to the public internet.
Restrict the application tier
Allow application instances only the required ports from the entry tier. Define a separate controlled path for updates and administration.
Isolate the data tier
Keep the database off public addressing. Limit network connections to the authorized application tier and authenticate the application when it accesses the database. Test backups and recovery separately.
Test the complete path
Test both allowed and denied flows, confirm actual routes and log events, and repeat after changes.
Govern cloud app use with a CASB
A cloud access security broker (CASB) is a category of controls that applies policies between users and cloud applications. Depending on the app, a CASB can inspect traffic inline through a proxy, review stored data through API integrations, or combine both approaches. Products differ in coverage and controls, so verify app support and technical limits before selection.
Visibility and app inventory
Identify approved and unapproved SaaS used for work, account types and sharing patterns. Validate discovery with business owners; an unfamiliar app does not automatically mean malicious activity.
Data policies
Set sharing, upload and storage policies for sensitive files according to each app’s API or traffic inspection capabilities. Test where controls such as DLP, quarantine and blocking actually work.
User and context
Use user, device management, location, risky actions and sharing context in decisions. Manage policies with documented exceptions, logging and business approval.
Understand control boundaries
A CASB does not automatically see every cloud resource or user action. Coverage depends on selected apps, connected accounts, API permissions, encrypted traffic and integration method. Use it alongside network, identity, endpoint and cloud configuration controls.