New answers tagged dmz
As with all security related questions, the answer is "it depends". It depends on the type of company you are, the type of services you run, how hardened your Internet facing services are, the data you are in custody of, what legislation you have to adhere to, Etc., Etc. Short answer - minimise the "attack surface" by limiting the addresses/ports between ...
OK, minimising connections between the DMZ and the LAN is a good rule of thumb though I wouldn't become a slave to this idea (if you have on-site email servers then your email service will be interesting to say the least if you force it to abide by your idea). Also, don't think this is a magical hacking defence. If someone compromises a server in the DMZ ...
This is a real big issue where on one hand we bother about a hacker gaining access to corporate data, and also think of keeping a read-only DB in the DMZ. But what are we going to put in the read-only DB? If it is sensitive PII data, it's simply not allowed by your IT security measures. I would say we have a proxy client on the application and have ...
Well you already pretty much list one of the issues with this setup, it is TCP only. Not only that but a session can be faked with relative ease from inside the DMZ. The ideal ideal solution to me sounds like treating the trusted LAN just like a regular user, send them out of your network and back again.
Top 50 recent answers are included