# SEC05-BP02: Control traffic at all layers

## Description

Security groups, NACLs, WAF.

## Implementation Guidance

- Security groups as primary
- NACLs for subnet rules
- WAF for web applications
- DDoS protection
- Egress filtering

## Risk Level

High - Uncontrolled traffic is dangerous.
