2.4. Allocating Resources in the DMZ
So everything public goes in the DMZ. But does each service need its
own host? Can any of the services be hosted on the firewall itself?
Should one use a hub or a switch on the DMZ?
The last question is the easiest: with the price of switched ports
decreasing every year, switches are preferable on any LAN, and
especially so in DMZs. Switches are superior in two ways. From a
security standpoint, they''re better because
it''s a bit harder to
"sniff" or eavesdrop traffic not
delivered to one''s own switch port.
Wireless Local Area Networks and Firewalls
Wireless Local Area
Networks (WLANs) are increasingly popular, due to their convenience
and their low cost (compared to running cable and terminating it to
data jacks). But network security professionals nearly unanimously
agree that WLAN segments should not be connected directly to
trusted/internal networks; they should instead be set up as DMZ
networks separated both from the internal network and from other
(wired) DMZs by a firewall.
Why? The main reason is because wireless networking is a radio
technology: all network traffic in a WLAN is broadcast over radio
waves that can be trivially eavesdropped by unauthorized passersby.
Besides the obvious privacy problem, this eavesdropping exposure also
makes it easier for an attacker to connect to and pretend to be a
legitimate user of a WLAN.
Emerging WLAN technologies such as WPA may effectively and
transparently encrypt all traffic to mitigate eavesdropping
exposures, but as of this writing, the predominant WLAN technology is
still 802.11b, a.k.a. "WiFi,"
typically implemented without WPA (which is backward-compatible with
802.11b). Although 802.11b natively supports encryption via the
"Wired Equivalent
Privacy" protocol, WEP is not trustworthy: it was
found to have fatal flaws very soon after its details were made
public.
Even if you use 128-bit WEP keys (the maximum key length WEP
supports), an attacker with WEP-cracking software needs only to
capture a few hours'' worth of your 802.11b WLAN
traffic to crack its WEP key and read all your WLAN packets at will
(and, potentially, to connect to your WLAN).
Isolating a WLAN segment outside of a firewall mitigates the exposure
to unauthorized access to the network, but what about the exposure of
data confidentiality? My best advice is not only to DMZ your WLAN but
also to run VPN software or to use only encrypted services such as
SSH, HTTPS, etc. on it (in addition to using
128-bit WEP).
|
(Unfortunately, this isn''t as true as it once was:
there are a number of ways that Ethernet switches can be forced into
"hub" mode or otherwise tricked
into copying packets across multiple ports. Still, some work, or at
least knowledge, is required to sniff across switch ports.) One of our assumptions about DMZ hosts is that they are more likely
to be attacked than internal hosts. Therefore, we need to think not
only about how to prevent each DMZed host from being compromised, but
also what the consequences might be if it is. One possible
consequence is the attacker using it to sniff other traffic on the
DMZ. We like DMZs because they help isolate publicly accessible
hosts, but that does not mean we want those
hosts to be easier to attack.
Switches also provide better performance than hubs: most of the time,
each port has its own chunk of bandwidth rather than sharing one big
chunk with all other ports. Note, however, that each switch has a
backplane that describes the actual volume of
packets the switch can handle: a 10-port 100 Mbps hub
can''t really process 1000 Mbps if it has an 800 Mbps
backplane. Nonetheless, even low-end switches disproportionately
outperform comparable hubs.
The other two questions concerning how to distribute DMZ services can
usually be determined by factors that are not security-related (cost,
expected load, efficiency, redundancy/failover, etc.), provided that
all DMZ hosts are thoroughly hardened and monitored and that firewall
rules (packet filters, proxy configurations, etc.) governing traffic
to and from the DMZ are as restrictive as possible.
Note that high-availability and load-balancing solutions leveraged in
DMZ devices and systems have important benefits for security, not
just for performance. Redundancy is one of the only effective
mitigators of Denial of Service attacks. |
لطفا منتظر باشید ...
