Do You Open the Firewall and Let the Traffic Flow In?

Taking a few minutes from Monday Night Football… Generally, when you want to make a service available to external customers you (should) build a complete DMZ design with multiple layers of security. This DMZ starts with external ACLs on routers that flow traffic to external firewalls that protect the DMZ. Inside the DMZ there’s a proxy layer that customer traffic is allowed to reach. Only the proxy layer, after more security features, is allowed to communicate with the application layer which could also be in another part of the DMZ for extra protection. But be honest. How many of you just open up the firewall, do some destination NAT, and let the traffic flow right into the data center? Come on, you can admit it. Many enterprises don’t have the money or expertise to setup a secure DMZ system as the front-end for their public applications, but they need to provide services to customers. The business needs takes priority over the reluctant security staff. So, the compromise is made that only HTTP to this specific IP will be let in. It’s not that bad, it’s only HTTP. A customer I used to work for was extremely serious about security. Every subnet in the network had to have an IDS monitoring traffic. All projects had to go through a strict security review. And then the business leaders demanded web access to e-mail….and they opened up firewall and in the traffic came…straight from the Internet. I’ve seen this in other customer networks I’ve worked on. It’s obviously not good, but very expedient. The problem is it starts small for a simple application that needs to be quickly provided to external customers. But then that application grows and grows and, next thing you know, it’s a critical customer portal which needs 99.999% uptime. Plus, other IT groups notice how easy it was to have the firewall opened to make applications customer accessible and they want it. “It takes too long to build a DMZ; you did it for them.” Now, you have several applications with external customer access through the firewall – all that need 99.999% uptime. So, be honest with yourself out there. You do this…don’t you? And, until something bad happens, you’re ok with it. Back to football….Bills up 17-10 !!!