DMZ Module

When to Use

Organisation with secure computing environment that connects to untrusted networks.

When NOT to Use

Single user environment e.g. Home user.

Typical Challenges

Skilled firewall administrators to ensure that firewall rules do not have errors that create holes. Skilled security and server engineers to implement and maintain hardened build for gateways.
Remodel an existing environment rather than building up an environment from scratch. To remodel the following approach is recommended:

• Isolate in the DMZ those services that have an "intermediate" role, such as web frontends, antivirus-servers, content inspection servers, SSL VPN portals, Captive portals, etc.
• Plan traffic rules on the firewall layer to route only the a very restricted set of services, especially concerning the traffic from the DMZ to the internal network and from the internet to the DMZ. Make sure, that there is absolutely NO direct traffic from the internal network to the internet
• Optionally add intrusion prevention systems in mainly two strategic points: in front of server networks, to ensure in depth defense and isolation of the sensitive data. As well as between internal network and DMZ, to contain propagation of worms and fast spreading zero day attacks throughout the network and on the Net.

Threat Resistance

Denial of Service, Network based attacks.

Assumptions

1) Encryption should be used for sensitive traffic, it may be necessary to break the session at the gateway (bastion host) to inspect traffic depending on content monitoring requirements. 2) The internet is a bad place and you need to protect your trusted computing environment from it!