Re: Rethinking the DMZ

[Jeff Moore <mail () JEFFMOORE COM>]

Security is like an Onion or an Ogre. It has many layers(End of horrible
Shrek reference! Sorry its been a long week.).

For us the layers are allot of overhead but I feel they are very very
valuable. Another thing to consider in your questioning is the changing
landscape of firewalls. If I were asking this question of our network I
would rephrase to say "Are NGFW DMZs relevant in our architecture?". The
part these play can be very different than a traditional firewall. Even if
there was not a deny any stance I would certainly think it would be
beneficial in controlling traffic. Threats etc. Minimizing targets and
areas affected is a major benefit. Also allot of attacks are utilizing
social engineering today to target a random person at Company A to get
access to their network. Without layers those types of attacks can easily
gain access.

Take all this with a grain of salt cause I am still livin in the 90s!!!


Jeff M



On Thu, Aug 30, 2012 at 2:09 PM, Youngquist, Jason R. <jryoungquist () ccis edu
> wrote:

>  We are thinking about changing our network architecture.****
>
> ** **
>
> As our network has grown and the complexity of our public facing systems
> and connectivity needs of those systems has increased, we are wondering
> what value our DMZ delivers.  ****
>
> ** **
>
> As an example, public facing systems in the DMZ that require access to
> LDAP/AD for AAA, SQL for database lookups, Exchange for mail delivery and
> relay, etc.****
>
> ** **
>
> For those of you with non-trivial public facing systems, where do you draw
> the balance line between security and access?  If our most visible public
> facing systems (most likely to be attacked) require internal AAA & SQL
> access, what are we protecting?  ****
>
> ** **
>
> Given current system requirements and the evolution of security, are the
> reasons for setting up a DMZ 15 years ago still valid, and is the value of
> maintaining a DMZ worth the associated costs and if not, what are the
> alternatives?  ****
>
> ** **
>
> ** **
>
> Thanks.****
>
> Jason Youngquist, CISSP****
>
> Information Technology Security Engineer****
>
> Technology Services****
>
> Columbia College****
>
> 1001 Rogers Street, Columbia, MO  65216****
>
> (573) 875-7334****
>
> jryoungquist () ccis edu****
>
> http://www.ccis.edu****



-- 
Jeff Moore
Desk (503) 877-4707 <https://www.google.com/voice?pli=1#phones>
Cell (503) 9 <https://www.google.com/voice?pli=1#phones>10-0756
Mail () JeffMoore com