Linux Server Security (2nd Edition( [Electronic resources] نسخه متنی

Chapter 2. Designing Perimeter Networks

A
well-designed perimeter network (the part or parts
of your internal network that have direct contact with the outside
worlde.g., the Internet) can prevent entire classes of attacks
from even reaching protected servers. Equally important, it can
prevent a compromised system on your network from being used to
attack other systems. Secure network design is therefore a key
element in risk management and containment.

But what constitutes a
"well-designed" perimeter network?
Since perimeter networks always involve firewalls, you might be
tempted to think that a well-configured firewall equals a secure
perimeter, but there's a bit more to it than that.
In fact, there's more than one
"right" way to design the
perimeter, and this chapter describes several. One simple concept,
however, drives all good perimeter network designs: systems that are
at a relatively high risk of being compromised should be segregated
from the rest of the network. Such segregation is, of course, best
achieved (enforced) by firewalls and other
network access-control devices.

This chapter, then, is about creating network
topologies that isolate your publicly accessible servers from your
private systems while still providing those public systems some level
of protection. This isn't a
chapter about how to pull Ethernet cable or even about how to
configure firewalls; the latter, in particular, is a complicated
subject worthy of its own book (there are many, in fact). But it
should give you a start in deciding where to put your servers before
you go to the trouble of building them.

By the way, whenever possible, the
security
of an Internet-connected perimeter network should be designed and
implemented before any servers are connected to
it. It can be extremely difficult and disruptive to change a
network's architecture while that network is in use.
If you think of building a server as similar to building a house,
network design can be considered analogous to urban planning. The
latter really must precede the former.

The Internet is only one example of an external network to which you
might be connected. If your organization has a dedicated Wide Area
Network (WAN) circuit or a Virtual Private Network (VPN) connection
to a vendor or partner, the part of your network on which that
connection terminates is also part of your perimeter.^{[1] [1]} Actually, "perimeter" has a
much broader definition than it used to. It used to mean
"the outer edge of your network,"
but nowadays it means "any place trusted systems
meet untrusted traffic." For example, in many
organizations, it's become common for external
vendors to support internal systems (e.g., via VPN connections or
modems); in that scenario, the perimeter extends as far inside the
network as the external vendors go.

Most of what follows in this chapter is applicable to any part of
your perimeter network, not just the part that's
connected to the Internet.