Re: How vulnerable server will become if placed on DMZ ?

From: Marlon Brown (marlon_brownj@hotmail.com)
Date: 08/21/02 

From: "Marlon Brown" <marlon_brownj@hotmail.com>
Date: Wed, 21 Aug 2002 07:29:37 -0700

That's right, I already 'disabled' OS services that I don't need, changed
'restrictanonymous' to "1" (If I change it to "2", that damn application
doesn't work right) - File & Print sharing and NetBios over TCP/IP is
disabled, so that would help.

That's not IIS, so no way for me to run "iislockdown" or something like
that.

I will configure IPSec filter in a testing machine and see how it goes.

Thanks for all your help

"karl [x y]" <jamescagney90210@excite.com> wrote in message
news:OB5NQlQSCHA.3732@tkmsftngp11...
> "Marlon Brown" <marlon_brownj@hotmail.com> wrote in message
> news:eIHhDoNSCHA.2272@tkmsftngp11...
> > I have a type of Web Server (proprietary web server).
> > This server needs to be accessed from the Internet.
> > I have a firewall and TCP 80 inbound and outbound should be configured
to
> > allow people to access the described server from the Internet.
> >
> > Third party software vendor recommended that the server is placed on the
> > "DMZ".
> > When it comes to security, how badly am I going to increase potential
> > threats if I put the server on the "DMZ" instead of keeping it "inside"
my
> > network ?
>
> The idea of a DMZ is not to subject your web server to greater risk, but
to
> protect your internal network from a compromised web server. A DMZ can
also
> give you greater control over what traffic is permitted and denied to and
> from which network. [e.g. right now I bet you have little or no control
or
> logging concerning what traffic flows between your internal network and
the
> web server]. A DMZ is generally considered better security for your
entire
> network as compared to what you probably have now, a single firewall.
>
> In setting up a DMZ, you face some choices... a single firewall with a
third
> network interface for an isolated DMZ network, a second firewall with the
> DMZ network in between the two firewalls, a second firewall with a third
> network interface, a proxy server, etc. The book Building Internet
> Firewalls is considered a little dated but describes firewall
architectures
> and filters.
>
> Setting up a web server without compromising your network security takes
> some knowledge. If you aren't already an expert at DMZs and other facets
of
> internet security, I would highly recommend finding a security consultant
to
> help. Hopefully you've already configured your web server and Windows
with
> the latest patches, settings and permissions using all available security
> hardening checklists. An awful lot of serious network compromises can
slip
> through a firewall on a single port such as TCP 80.
>
>
>
>
>

Relevant Pages

  • Ang: RE: Firewall and DMZ topology
    ... Network Engineer ... Subject: Firewall and DMZ topology ... > The Gartner Group just put Neoteris in the top of its Magic Quadrant, ...
    (Security-Basics)
  • Re: Lets talk about firewalls - what do we as a group think a firewall should be/have?
    ... part of the same network as the LAN. ... Each interface of a firewall should be distinct from ... interfaces, so a "DMZ interface" is not a requirement. ...
    (comp.security.firewalls)
  • Re: Firewall and DMZ topology
    ... > network, Windows and Linux. ... > laptop used as a simple firewall setup. ... > machine and placing it in a DMZ. ... > internal network, one for the DMZ and one for the Internet. ...
    (Security-Basics)
  • RE: Basic Network Configuration
    ... > IMHO the second rule is void, since no traffic should bypass the DMZ. ... that originates from your internal network. ... There is no point in implementing the same firewall ... >> really achieve this benefit if the boxes run different OS ...
    (Security-Basics)
  • RE: Security from VPN connections
    ... You could also put you internal VPN interface out side of the firewall on ... through that DMZ into your internal network. ...
    (Security-Basics)