Date: Sat, 24 Nov 2001 22:48:58 -0800 From: "Crist J. Clark" <cristjc@earthlink.net> To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca> Cc: Fernando Germano <fgermano@audiotel.com.ar>, security@FreeBSD.ORG Subject: Re: Best security topology for FreeBSD Message-ID: <20011124224858.B228@gohan.cjclark.org> In-Reply-To: <200111231250.fANCoha19105@cwsys.cwsent.com>; from Cy.Schubert@uumail.gov.bc.ca on Fri, Nov 23, 2001 at 04:49:46AM -0800 References: <20011122031739.A226@gohan.cjclark.org> <200111231250.fANCoha19105@cwsys.cwsent.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Nov 23, 2001 at 04:49:46AM -0800, Cy Schubert - ITSD Open Systems Group wrote: > In message <20011122031739.A226@gohan.cjclark.org>, "Crist J. Clark" writes: > > It is sad to see this poor design, > > > > Internet > > | > > | > > Firewall--"DMZ" > > | > > | > > Internal > > > > Used so very, very much these days (I think thanks to several firewall > > vendors pushing this as a standard design). > > > > A much better design, is > > > > Internet > > | > > | > > Firewall1 > > | > > | > > DMZ > > | > > | > > Firewall2 > > | > > | > > Internal > > > > (This design is actually where the term "DMZ" comes from since it > > actually looks like one here.) > > Given the capability of today's firewalls, packet filtering software > and packet filtering capabilities within routers, I don't see what > the advantage of the second design would be in 2001. Defense in depth. Examples: A glitch/security breach in Firewall1's ruleset/software does not necesarily expose the internal network. Any vulnerabilities in Firewall2 are harder to exploit when protected by Firewall1. > Actually today (2001), the second design is quite dangerous. Sure it > protects your internal network, however it is more difficult to > contain compromised systems from being used as a launching point to > elsewhere on the Internet. I don't see why this is true. > If you want the additional protection of security through depth, try > this: > > Internet > | > | > Firewall1 -- DMZ > | > | > Firewall2 > | > | > Internal > > What does this give you? Well, your DMZ can be easily configured to > protect not only you but make it difficult to launch attacks from your > DMZ. The second firewall is a redundant firewall. If you see any > messages in the second firewall's logs, you might want to investigate > a possible compromise of your first firewall. Many organisations do > this. For example, firewall 1 could be a packet filtering router while > firewall 2 could be firewall with various proxy services, e.g. IP > Filter's FTP proxy, or a firewall with NAT capability. Of course all > of this depends on what you're trying to protect and how much you're > willing to spend to protect whatever you're trying to protect. For > many applications one firewall should be enough. This is not as good, IMHO. One typically allows special access between DMZ hosts and the internal network. Putting these rules on Firewall1, which also faces the hostile network, potentially weakens security. > Also, one could set up other firewalls within an internal network to > control which hosts within your internal network have access to your > most sensitive data, e.g. your financial records. Yep, access controls between different "areas" (for a business: finance, HR, marketing, engineering, etc., for a university: student housing, public machines, academic departments, the registrar, other administrative groups, etc.) of your internal networks is always a good idea when the security benefits balance against the costs. -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011124224858.B228>