Domains of Trust and Network Design
Although it is easy to define domains on paper, in your own network you will find that trade-offs must be made. Your network, and its users, very rarely falls into obvious and nonoverlapping categories. In addition, if your network was designed purely from a security standpoint, it might not function very well in terms of performance, application support, and general usability. As an example, consider an access-control-centric design for a campus network, as shown in Figure 12-9.
Figure 12-9. Security-Centric Campus Design
Figure 12-9. Security-Centric Campus Design
Here you can see seven different domains of trust defining the network topology. Security devices aren't put in place, but it is assumed that they exist at the points between trust domains (more on this in the following "Choke Points" section). Although it is possible to design your network as shown in the figure, there are several caveats:
• User mobility The design in the figure assumes that each user will always be in one location. What if users are spread across several buildings (or cities)? What if users must work from other locations temporarily? Standard 802.1x (Chapter 9, "Identity Design Considerations") can mitigate this issue somewhat, but for many networks it isn't yet viable.
• Network backups With server resources spread across several segments, how are you going to back up these systems on a regular basis? Without separate backup systems or a lot of VLAN trunking, chances are you're not.
• Intradomain access control If you decide to limit the access to a server resource within a domain, how do you do it without deploying more hardware? If you must do this in several different domains, how does this scale in terms of cost and management expense? The network shown in Figure 12-9 looks a lot like several small networks, each with its own management and equipment.
Depending on the applications and network size, there are a dozen or more additional considerations for such a design. As has been touched on throughout this book, there is a trade-off between security and usability. In domains of trust, the same idea holds. The more rigid you are on domain definitions and topology, the less usable and manageable your network will be. To make sound design decisions, you must consider the impact of your security decisions on the surrounding network. Figure 12-10 shows a similar design, balanced to consider the three factors previously listed as concerns.
Figure 12-10. Balanced Domain of Trust Campus Design
Figure 12-10. Balanced Domain of Trust Campus Design
The following list details how the concerns of the previous design are addressed in Figure 12-10:
• User mobility All users are in a central location and are not distinguished from one another at the network level. This puts more responsibility on the applications to securely authenticate users but allows for user mobility. User segmentation, if needed for network scalability reasons, can be based on physical location only, with all hosts residing in the same domain of trust.
• Network backups All the internal server systems are connected to the same switch. By using a technology such as private VLANs, you can segment the access on that switch to the different departments. A network backup system could still be used in this location to gain access to all the servers in the same way that the router can gain access to all the servers. When using private VLANs, for example, set the network backup system as an additional promiscuous port.
• Intradomain access control Because only server resources are contained in the individual department domains, any amount of access control can be put on the connection between the domains.
The extent to which you can make compromises in security to benefit usability or management has a lot to do with the disparity in trust of the domains involved. In Figures 12-8 through 12-10, the domains that were adjusted to increase usability and manageability were already fairly close to one another in terms of trust. Although moving the external server onto the same switch that the other servers are on in Figure 12-10 might make backups easier, the impact from a security perspective is too great. This concept comes up again in the following section.
Continue reading here: Choke Points
Was this article helpful?