Favor security groups over NACLs