Re: Flat vs Segmented DMZ's

[Paul Robertson <proberts () patriot net>]

On Wed, 6 Nov 2002, WhtWlf2001 wrote:

> I'm hoping to get some feedback (Pros/Cons) from the list members on a Flat vs. Segmented DMZ
> structure. We currently have about 20 hosts segmented off to 4-5 different DMZ interfaces on a CP
> firewall. With the exception of having a seperate MGMT DMZ, I'm curious about the
> benefits/detriments to having this segmented infrastructure. Today we offer only limited web
> services (http,ftp,owa) via the web. 

Not sharing layer 2 provides a level of independence that can stop a 
server from being used to compromise another server, intercept traffic, or 
provide the sorts of boundaries that are appropriate for administrative 
access to networks which cross administrative zones.  Things also tend to 
scale better.  The downside is cost and administrative overhead.  

If you have real physical redundancy (rather than VLAN stuff) then you 
also get an advantage in disaster recovery of being able to temporarily 
move things over to a functional interface/switch with the appropriate 
rule changes.

Seperation is almost always a good thing from a security standpoint, and 
always gives you more places to place access controls.  The opposite of 
that is that it can increase complexity and be more expensive.  


Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts () patriot net      which may have no basis whatsoever in fact."
probertson () trusecure com Director of Risk Assessment TruSecure Corporation

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards