to DMZ or not to DMZ, that is the question?

[ass17]

Hi,

 

We are re-assessing our security on our network and was wondering if people still DMZ mail, web servers etc?

 

Like most, we wish to limit specific servers, in terms of external user access, from attacks. So allow mail server to contact DC, DNS etc but nothing else like user data.

 

So to my question I assume the cheapest is to create a DMZ on smoothwall and put specific servers in their. or is there a better way, and functioanliy/security outways the costs? For example is Citris NetScaler an option?

 

I would love some advice please what other have done to secure services available to external users...

 

Thanks

[Quackers]

DMZ is still best practice, but does your firewall have Intrusion Prevention System (IPS)?

 

IPS will be more helpful , these are the attacks for our site just this afternoon. Our firewall spotted them and blacklisted their IPs. It looks for PHP, Joomla, RDP, SSH and over 5000 other attack types. If you don't have IPS and have a few internet facing services i would get one.

 

[cpjitservices]

Never DMZ, just poke holes in your firewall to allow/block traffic.

[CyberNerd]

Never DMZ, just poke holes in your firewall to allow/block traffic.

 

Do you guys do consultancy work?

[cpjitservices]

LOL I can do

[CyberNerd]

LOL I can do

 

It's ok I was joking.

[RobD]

But you do poke holes in your firewalls with a DMZ i.e. Internet >> Firewall >> DMZ >> Firewall >> Internal network.

 

Edit: missed a joke, I'm an idiot.

Edited January 26, 2016 by RobD
Idiot

[cpjitservices]

It's ok I was joking.

 

Me too. - about the DMZ anyway.

[CyberNerd]

Sorry, I was being facetious again. I'll try to stop.

 

The point of a DMZ is that you put servers in it that could become compromised because they have holes opened to the internet. If that server becomes compromised, it is very difficult to use that server to gain access to other servers on your interlan lan (your most precious databases etc). The advantage of the DMZ is that you don't need to mess about with FW rules internally and it avoids the situation where your compromised webserver is running on the same internal network as your sims. It makes things more difficult for an attacker and hence is best practice.

[ass17]

Come on guys constructive please :-)

 

Will an IPS really stop everything? I mean by having a DMZ you are limiting what a hacker is exposed to if they compromise the domain admin account or such like...

[CyberNerd]

Come on guys constructive please :-)

 

Will an IPS really stop everything? I mean by having a DMZ you are limiting what a hacker is exposed to if they compromise the domain admin account or such like...

 

I do apologise.

 

Neither IPS nor DMZ will stop everything - only unpluugging the cable will do that. All you are trying to do is mitigate risk. IDS/IPS and DMZ will help so are worth doing.

[cpjitservices]

Sorry, I was being facetious again. I'll try to stop.

 

The point of a DMZ is that you put servers in it that could become compromised because they have holes opened to the internet. If that server becomes compromised, it is very difficult to use that server to gain access to other servers on your interlan lan (your most precious databases etc). The advantage of the DMZ is that you don't need to mess about with FW rules internally and it avoids the situation where your compromised webserver is running on the same internal network as your sims. It makes things more difficult for an attacker and hence is best practice.

 

I know mate.... Calm Down!! - I was merely making a joke since this is what was advised to me by a client of mine.... Hmmmmmmmmmmm lol. Things have changed in that situation.

 

As above though, IDS/IPS, DMZ will help but nothing will stop an attacker if they want to get in.

Edited January 26, 2016 by cpjitservices

[Davit2005]

Have set up a DMZ here with proxy servers for SharePoint and Skype. When time and money allows will do Exchange and Office365 SSO. The most difficult thing was getting the AD traffic through, must of needed about 22 different ports opening up to talk to Domain .

[ass17]

Our sims server is exposed to external access through very specific ports, for the teacher app to function. But I wouldn't want to put sims in a dmz with the mail and web server.

 

The biggest problem is that a lot of personal data is now being exposed to the outside world, like sims, work folders feature etc

 

So what do you do? Yes mail and web can go DMZ but what about sims or staff data server hosting work folders etc...

[CyberNerd]

Our sims server is exposed to external access through very specific ports, for the teacher app to function. But I wouldn't want to put sims in a dmz with the mail and web server.

 

The biggest problem is that a lot of personal data is now being exposed to the outside world, like sims, work folders feature etc

 

So what do you do? Yes mail and web can go DMZ but what about sims or staff data server hosting work folders etc...

 

If it isn't avoidable you should at least proxy these connections via apache or something

[ass17]

If it isn't avoidable you should at least proxy these connections via apache or something

 

In what way, can you explain your thinking, thanks

[FN-GM]

We are moving more and more into the cloud to avoid opening any ports. Moving to Office 365 is an example of this. Our DMZ has 2 firewalls to get through to reach the internal network. I am considering tweaking things so we have 2 DMZ's. One for servers that proxy to the main LAN in some way and another that contains servers that do not and different security levels accordingly.

[CyberNerd]

In what way, can you explain your thinking, thanks

I don't think it's a good idea to open anything directly into the internal network, but I don't think its good to put SIMS database into the DMZ either. At the end of the day you need to do what the vendor (capita) support and if they say it is the best thing to do then go for it. With web services you can run a reverse proxy on your webserver and just open that up to the specific port on the SIMS. I don't know enough about security to say either way whether it would really help in a practical sense - but it's very easy to do if you have a web server in the DMZ already.

 

We are moving more and more into the cloud to avoid opening any ports. Moving to Office 365 is an example of this. Our DMZ has 2 firewalls to get through to reach the internal network. I am considering tweaking things so we have 2 DMZ's. One for servers that proxy to the main LAN in some way and another that contains servers that do not and different security levels accordingly.

 

Absolutely agree with this. We moved most to Google and it must be more secure (overall) than school technicians (me!) randomly letting the internet in without 24/7 support, pen testers and recognised security protocols.

[ass17]

We are moving more and more into the cloud to avoid opening any ports. Moving to Office 365 is an example of this. Our DMZ has 2 firewalls to get through to reach the internal network. I am considering tweaking things so we have 2 DMZ's. One for servers that proxy to the main LAN in some way and another that contains servers that do not and different security levels accordingly.

 

Two firewalls, please can you explain your thinking behind this, I interested to know.

 

As it stands we will use our smoothwall as our firewall, it is kind of the heartbeat of our network, internal and wifi.

 

Could we in essence DMZ none critical data servers that are accessible to external and create individual DMZ's per each server that has critical data on it?

[FN-GM]

Two firewalls, please can you explain your thinking behind this, I interested to know.

 

As it stands we will use our smoothwall as our firewall, it is kind of the heartbeat of our network, internal and wifi.

 

Could we in essence DMZ none critical data servers that are accessible to external and create individual DMZ's per each server that has critical data on it?

 

Its pretty standard to have 2 firewalls in industry. They are 2 different vendors, if one has a vulnerability the other should stop it. Any connection to the internet goes via 2 firewalls. We also only allow secure and encrypted communications between the DMZ and main network. The firewalls are not virtual they are appliances on their own hardware.

[CyberNerd]

Two firewalls, please can you explain your thinking behind this, I interested to know.

 

As it stands we will use our smoothwall as our firewall, it is kind of the heartbeat of our network, internal and wifi.

 

Could we in essence DMZ none critical data servers that are accessible to external and create individual DMZ's per each server that has critical data on it?

 

You don't need two physical firewalls, a (reasonably) cheap Cisco ASA will do a really good job of this. We essentially have 7 DMZ's as we treat each wireless VLAN as a discrete "DMZ" as it is a semi-trusted network.

[ass17]

Our smoothwall box controls access to each of the six virtual interfaces that each wifi network is on, so rules are in place to allow specific communication across networks, so I suppose it's kind of a DMZ for each network.

 

We do also have a TMG firewall also which is setup with basic rules but mainly acts as a second proxy for users that need access out to government websites, that for some reason smoothwall won't allow because of our rule setup.

 

So your advice is to use TMG as a second level firewall? I'll check with my network manager to see how they work specifically and how they are wired, I suspect as it stands TMG goes through smoothwall transparently but I could be wrong.

[CyberNerd]

@ass17

 

Top Tip: Teachers (read SLT) are notoriously bad at trusting their staff. They would sooner get a consultant in to tell them X or Y than rely on a member of their own staff to do it. I'm not entirely sure why; it happens at all levels, not just support staff. probably to do with perceived perceptions of pay vs ability. They are also terrible at getting IT staff properly trained. If you're clever you can play this to your advantage - sure you could ask around here and get a reasonable answer. The smart thing to do is to play on this. If SLT really want something done (ie access to data from home, securely) and they are not prepared to outsource it entirely then get them to pay for it, in a way that you get trained!

The choices seem to be: 1) DIY. It's not too hard, maybe it works out fine, maybe you make a hash of it. If it's the latter it's on your head. 2) Get in somebody who does this as a full time job; get them to sell you some hardware and talk you though it. You will learn a LOT from spending a day or so with a decent engineer and it's all on them if it goes tits. Plus it will save you hours of work. Personally I went for #2 first, then #1 after Id learned it from engineer in #1.

[ass17]

@ass17

 

Top Tip: Teachers (read SLT) are notoriously bad at trusting their staff. They would sooner get a consultant in to tell them X or Y than rely on a member of their own staff to do it. I'm not entirely sure why; it happens at all levels, not just support staff. probably to do with perceived perceptions of pay vs ability. They are also terrible at getting IT staff properly trained. If you're clever you can play this to your advantage - sure you could ask around here and get a reasonable answer. The smart thing to do is to play on this. If SLT really want something done (ie access to data from home, securely) and they are not prepared to outsource it entirely then get them to pay for it, in a way that you get trained!

The choices seem to be: 1) DIY. It's not too hard, maybe it works out fine, maybe you make a hash of it. If it's the latter it's on your head. 2) Get in somebody who does this as a full time job; get them to sell you some hardware and talk you though it. You will learn a LOT from spending a day or so with a decent engineer and it's all on them if it goes tits. Plus it will save you hours of work. Personally I went for #2 first, then #1 after Id learned it from engineer in #1.

 

You speak a lot of sense, I'm going to use this for future projects [emoji1]

[ass17]

I think instead of trying to put servers in to different DMZ's, I'm now thinking the answer to turn the TMG into a reverse proxy.

 

That way you'll have:

Internet --> smoothwall --> TMG Reverse Proxy --> internal servers

 

If I have it the right way around and in my DMZ is a simply the reverse proxy. Does anyone else use this approach?