Data Compliance (PII and PHI) Network Architecture

This architecture is designed to maintain PII (Personally Identifiable Information) data compliance, adhering to strict security and regulatory requirements. It leverages a multi-VPC, shared networking approach with granular subnet isolation and robust security controls.

1. VPC Structure and Isolation
The architecture employs a logical separation of environments through dedicated Virtual Private Clouds (VPCs):

• Development VPC: Hosts development and QA environments.
• Management (DevOps & Monitoring) VPC: Centralized VPC for DevOps tooling, monitoring, and administrative tasks across all environments.
• Staging VPC: (Implicitly similar to Production VPC configuration) A pre-production environment for rigorous testing before deploying changes to production.
• Production VPC: Dedicated for live production environments handling critical applications and PII data.

This multi-VPC strategy ensures strong isolation, preventing unauthorized access and impact between different stages of the software development lifecycle.
2. Shared Networking Approach
The design adopts a shared networking approach, enabling the deployment of multiple projects within the same network infrastructure. This promotes reusability and simplifies network management while maintaining segregation through strict access controls at the project and subnet levels.
3. Application Deployment (Development & Production VPCs)
Applications deployed within the Development and Production VPCs adhere to a highly segmented subnet strategy with strict Network Access Control Lists (NACLs) to enforce an "air gap" and minimize the attack surface. This granular isolation ensures data compliance and auditability.
Subnet Isolation:

• Public Subnet: Hosts internet-facing resources.
• Frontend Subnet: Runs all frontend-related services.
• Microservices Subnet: Dedicated for application-related microservices.
• Controller Subnet: Manages Kubernetes master nodes, VM discovery services, and other cluster control resources.
• DB Subnet: Contains database resources.
• PII Service Subnet: Specifically for services handling PII data.
• PII DB Subnet: Stores PII databases.
• Tools & Monitoring Subnet: For application-specific tools and monitoring resources.
• External Service Subnet: For external API services requiring internet access. All other private subnets are strictly isolated without direct internet access.

This stringent network segmentation ensures logical separation and single responsibility for each subnet, simplifying monitoring and auditing.
PII Data Compliance Controls:

• Strict Access Controls: PII resources have stringent roles and permissions, controlling which services and ports can connect. For example, PII services have access only with the Microservices Subnet.
• Authentication and Authorization: Strictly monitored via ID tokens, enabling detailed auditing of "who, where, and when" access, critical for data compliance and regularity.
• Service Mesh Architecture: Implemented for centralized end-to-end encryption (transit-level encryption) and comprehensive monitoring of requests and responses.
• PII Data Classification: PII data is classified, and access is understood (e.g., email and phone numbers decrypted only when sending emails or SMS).
• Encryption at Rest and Column-Level Encryption: PII service and DB implement both column-level and encryption at rest.
• PII DB Visibility: PII DB provides visibility into data access, recording which columns are accessed by which microservices during queries.

4. Management VPC (DevOps & Monitoring)
The Management VPC centralizes resources for monitoring all environments and managing DevOps operations, including software and application deployment to development and production.
Subnet Isolation:

• Public Subnet: Hosts internet-facing management resources.
• DevOps Subnet: Runs DevOps tools (e.g., Jenkins, Packer, Puppet).
• Artifact Subnet: Manages artifact repositories (e.g., JFrog, Nexus, Harbor).
• Monitoring Subnet: Hosts monitoring services (e.g., Prometheus, Thanos, Grafana, Elastic Service).
• Controller Subnet: Manages Kubernetes master nodes and other control resources for the management cluster.
• DB Subnet: Contains database resources for management tools.

High-Level Responsibilities of Management VPC:

• Golden Image Creation: Generates base images for development and production VMs.
• Vulnerability Checks: Performs vulnerability scanning of software and libraries before deployment.
• SAST and DAST Execution: Conducts Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• Synthetic Testing: Executes synthetic transactions to monitor application availability and performance.
• Artifact Maintenance: Manages central artifact repositories.
• Resource Monitoring: Monitors resources and services across all environments.
• Resource Provisioning: Provisions resources in development and production.
• Source Code Management: Manages source code repositories.
• Code Pipeline: Manages CI/CD pipelines for software, patching, application, container, and configuration deployments.
• Temporary Agents/VMs/Containers: Creates temporary resources for building applications, golden images, and vulnerability checks.
• Software Management Tools: Runs tools like SaltStack, Puppet, and Ansible for configuration management.
• Security Patching & Versioning: Manages security patching and versioning of golden images.
• Centralized Artifact Management: Manages artifacts for central repositories (e.g., Maven, Pip).

5. Common Networking Security and Monitoring
This architecture incorporates common security and monitoring controls across all environments:

• SSH Tunnel: For secure access to private VMs.
• Common Firewall Rules: Consistent firewall policies across environments.
• Flow Logs: To monitor network traffic and identify anomalies.
• Log Monitoring: Centralized logging for comprehensive auditing and troubleshooting.
• Alerting: Based on monitoring logs for proactive incident response.
• Web Application Firewall (WAF): To protect internet-facing applications from common web exploits.
• Common IAM Roles: For consistent management of networking resources.
• Shared Resources: Secure sharing of resources via buckets between environments. ## High-Level Quality Attributes and Compliance

This networking architecture is designed with the following quality attributes and compliance standards in mind:

• ISO Standard Meeting: The stringent controls, documentation, and auditing capabilities inherent in this architecture contribute significantly to meeting various ISO standards, particularly ISO 27001 for Information Security Management Systems. The focus on data classification, access control, and continuous monitoring aligns with ISO 27001 principles.
• Air Gap Architecture: The strict network segmentation, particularly the absence of direct internet access for most private subnets and the isolation of PII data, effectively creates an "air gap" for sensitive data. This significantly reduces the potential attack surface.
• Reduced Surface Attack: Through micro-segmentation, minimal open ports, strict NACLs, and the isolation of PII data, the attack surface is drastically minimized. This limits the potential entry points for malicious actors and contains the blast radius of any successful attack.
• Monitoring: Comprehensive monitoring is central to this architecture.
  • Network Flow Logs: Provide visibility into network traffic patterns.
  • Centralized Logging: For all application, system, and security events.
  • Application Performance Monitoring (APM): Via service mesh and dedicated monitoring tools.
  • Security Information and Event Management (SIEM): (Implied by log monitoring and alerting) for correlation and analysis of security events.
  • Alerting: Proactive notification of security incidents and operational issues.
• Data Compliance (PII and PHI) and Data Regularity (GDPR, CCPA):
  • PII/PHI Segregation: Dedicated subnets for PII services and databases are a cornerstone.
  • Encryption: In-transit (service mesh) and at-rest (column-level and disk encryption) for PII/PHI.
  • Access Control: Granular, audited access controls to PII/PHI resources, enforced through IAM and service mesh.
  • Auditability: Detailed logging of all access to PII/PHI, enabling full audit trails for compliance reporting.
  • Data Classification: Understanding and classifying PII/PHI to apply appropriate controls.
  • Regulatory Alignment: The architecture's emphasis on data minimization, access control, encryption, and audit trails directly supports compliance with regulations like GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act).
• Security: Multi-layered security approach:
  • Network Security: VPCs, subnets, NACLs, Firewall Rules, WAF.
  • Identity and Access Management (IAM): Least privilege principle, ID token-based authentication.
  • Data Encryption: In-transit and at-rest.
  • Vulnerability Management: SAST, DAST, Golden Image vulnerability checks.
  • Security Monitoring: Flow logs, centralized logging, alerting.
  • Patch Management: Automated patching of golden images.
• Auditing:
  • Comprehensive Logging: All network traffic, system events, application logs, and access attempts are logged.
  • Immutable Logs: Logs are designed to be tamper-proof for integrity.
  • Centralized Log Management: For easy access and analysis during audits.
  • Audit Trails: Detailed records of all changes, deployments, and access attempts.
• Testability:
  • Staging Environment: A replica of production for rigorous testing of changes before deployment.
  • Isolated Development/QA Environments: Allow for independent testing without impacting production.
  • Synthetic Testing: Automated checks for application health and performance.
• Deployment:
  • Automated CI/CD Pipelines: Managed by the Management VPC for consistent and repeatable deployments.
  • Golden Images: Ensures consistent and secure base environments.
  • Infrastructure as Code (IaC): (Implied by automated provisioning and configuration management tools) for repeatable and version-controlled infrastructure.
• Performance:
  • Distributed Architecture: Microservices and segregated databases can be scaled independently.
  • Network Design: Efficient routing within VPCs and subnets.
  • Monitoring: Proactive identification and resolution of performance bottlenecks.
• Cost:
  • Shared Networking: Can lead to cost efficiencies by centralizing certain network services.
  • Resource Optimization: Monitoring and management tools help optimize resource utilization.
  • Scalability: Allows for scaling resources up or down based on demand, potentially reducing unnecessary expenditure.
  • Operational Efficiency: Automation of deployment and management tasks reduces operational costs.