The best way to thing about security groups is that they are switch based firewall rules.