RE: [fw-wiz] Sources for Extranet Designs?

From: Bob Alberti (alberti_at_sanction.net)
Date: 02/23/04

  • Next message: Wes Noonan: "RE: [fw-wiz] Sources for Extranet Designs?"
    To: "Firewall-Wizards" <firewall-wizards@honor.icsalabs.com>
    Date: Mon, 23 Feb 2004 14:08:54 -0600
    
    

    One thing I always wonder about in Extranet designs: how liable are you
    (the host of the Extranet) if two of your Extranet customers are
    competitors? If Customer A can hack your Extranet to, for instance, inspect
    Customer B's orders, or even to hack Customer B's network, how liable are
    you for not providing a more secure Extranet environment?

    Its one thing to protect the host organization from Extranet clients: its
    another entirely to protect clients from each other.

    -----Original Message-----
    From: firewall-wizards-admin@honor.icsalabs.com
    [mailto:firewall-wizards-admin@honor.icsalabs.com]On Behalf Of Wes
    Noonan
    Sent: Monday, February 23, 2004 1:31 PM
    To: 'Baumann, Sean C.'; 'R. DuFresne'
    Cc: 'Paul Robertson'; firewall-wizards@honor.icsalabs.com
    Subject: RE: [fw-wiz] Sources for Extranet Designs?

    > 1.) If you say you should never allow access to resources on your
    > protected or internal network, how do you handle giving access to
    > services that reside on machines that cannot be duplicated (i.e.
    > expensive mainframes)?

    There are a couple of approaches that I can think of off hand. Approach 1 is
    to design the services with extranet connections in mind. Simply put, maybe
    the mainframe isn't the right place to house that resource. This is probably
    not the answer that you want to hear though. Approach 2 is to accept that
    you have a business limitation that is going to force you to implement a
    less than ideal security solution. At that point, you mitigate it. What
    precise ports need to be opened from the extranet to the internal resource
    and grant *only* that access. If they need SQL access but not NFS access
    then make sure that your firewall only permits SQL traffic to pass between
    the two networks. Things like that.

    > 2.) Do most companies require routable address on their extranet?
    > Currently we use RFC1918 address for our extranet, but we see that this
    > will become a problem in the future as we add partners.

    Depends. Assuming that you are going to be using firewalls and advertising
    your internal resources as something else (through the use of NAT, etc.)
    then you can do that and make the routable addresses what the extranet
    partners think they are going to connect with. That being said, you can
    pretty much pick any RFC1918 address space at that point and use it in a
    similar fashion. The obvious alternative is that someone will need to change
    their address space.

    More detailed design you will probably have to pay me for. :-)

    One thing that this scenario really graphically depicts is why separation of
    resources is such a valuable objective. Sure, it sounds really nice to have
    all your stuff running on a mainframe running Linux hosts but these are the
    kinds of security problems you will then run into. (feel free to expand this
    statement as you see fit - i.e. integrated firewall/ids/content filter/spam
    control/virus scanning or separate switches vs. VLANs).

    HTH

    Wes Noonan
    mailinglists@wjnconsulting.com
    http://www.wjnconsulting.com
    Hardening Network Infrastructure - A concise how to guide
    Available Spring 2004
    Order at http://tinyurl.com/2nof4

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards


  • Next message: Wes Noonan: "RE: [fw-wiz] Sources for Extranet Designs?"

    Relevant Pages

    • RE: [fw-wiz] Sources for Extranet Designs?
      ... be accessing this same network. ... One thing I always wonder about in Extranet designs: ... If Customer A can hack your Extranet to, for instance, ... Its one thing to protect the host organization from Extranet clients: ...
      (Firewall-Wizards)
    • RE: [fw-wiz] Sources for Extranet Designs?
      ... > One thing I always wonder about in Extranet designs: ... If Customer A can hack your Extranet to, for instance, ... > precise ports need to be opened from the extranet to the internal resource ... > Hardening Network Infrastructure - A concise how to guide ...
      (Firewall-Wizards)
    • What is the best way to handle old browser versions?
      ... We have an Extranet with one customer with 20,000 users that has, ... standardized on Netscape 4.77 for the entire company. ... For example, MVC pattern, etc.? ...
      (microsoft.public.dotnet.framework.aspnet)
    • Portal Area or WSS site?
      ... content to customer from our WSS sites. ... accessing their content via Extranet. ... One possible solution is to target content from a site to ... with some additional collaboration components. ...
      (microsoft.public.sharepoint.portalserver)
    • PIX firewall troubles
      ... Users from the Extranet want to connect to the webserver on IP address ... access-list Inside permit tcp 172.31.32.0 255.255.240.0 gt 1023 host ... access-group Outside in interface outside ...
      (comp.security.firewalls)