Re: Philosophy of DMZ

["Barros, Jacob" <jkbarros () GRACE EDU>]

The other debate here... Where is a server less susceptible to
compromise.. the DMZ or the internal network? We don't have to get into
that discussion but any comments are welcome.

We have some here of the impression that anything in the DMZ is a
'sacrificial lamb'.  This new solution is mission critical to the
institution.  Can you quell the nay-sayer's fears?  Any best practices
you can reference?  

Thanks for all the responses.


-----Original Message-----
From: The EDUCAUSE Security Discussion Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Michael J.
Benedetto
Sent: Tuesday, April 19, 2005 4:41 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Philosophy of DMZ


Jake:

Why not move the "internal" server to a DMZ and write the firewall rules
so that both internal and external users can reach that system?

-Mike

-----Original Message-----
From: The EDUCAUSE Security Discussion Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Barros, Jacob
Sent: Tuesday, April 19, 2005 5:31 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Philosophy of DMZ

I've run into a situation where a solution we are implementing requires
a web server to be on our inside network but needs to be accessed
externally.  This is happening much more frequently than I would like.
We're doing some long-term planning and my office would like some
feedback from other institutions.

If I'm going to have to keep adding servers that can be accessed
directly, is there still reason to have a DMZ? My understanding of
having a DMZ, is to not allow public external access to internal servers
and all requests to internal servers should be answered by a
proxy/reverse proxy server.  Am I just an idealist?

Can anyone share experiences with proxying?  Anyone ever scrap their
DMZ?  Any policies that you can share on external access to internal web
servers?

Jake Barros
Grace College

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/groups/.

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/groups/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.