Choke Points
In the previous section, all the L3 interconnections in each design were made by using basic routers. In today's designs, you have L3 switches and firewalls as other potential interconnection points. In addition, technologies such as IPsec, NIDS, and content filtering can help define the boundaries between these domains of trust. The combination of hardware and software that makes up a network transit point between two domains of trust is called a choke point.
Deciding which choke point is appropriate for a given trust boundary is a critical element in secure network design. Choosing too weak a security control devalues the creation of the trust domains to begin with. Choosing too strong a control adds capital, management, and usability costs that might not be justified.
One of the easiest ways to start down this decision process is to consider the trust delta (or difference) between the two domains. Figure 12-11 shows a simplified version of the domains of trust shown in Figure 12-8. Here only three domains are represented.
Continue reading here: ISP Router
Was this article helpful?
Readers' Questions
-
Frodo5 months ago
- Reply
-
Selina Hornblower5 months ago
- Reply
-
marhta5 months ago
- Reply
-
adaldrida9 months ago
- Reply
-
sointu9 months ago
- Reply
-
Susanna12 months ago
- Reply
-
Danielle Silva1 year ago
- Reply
-
Maria Nurmela1 year ago
- Reply