Figure 1211 Three Domains of Trust
|
j |
|||
|
g |
- I |
||
|
Uwr PCs |
|||
|
a |
|||
|
Data Ceniei Trust Dû maln |
Ca mous LAN Trtjst Domain |
Inlerrtet Tr jsc Domain |
|
H:gbTrust J No Trust
H:gbTrust J No Trust
All three domains must be connected to one another. The data center should reach the Internet by way of the campus LAN. Looking at the trust levels of the domains, you see that the Internet is completely untrusted, the campus LAN is fairly trusted, and the data center is highly trusted. When deciding which choke point technology to use, start by considering this delta and then evaluate the direction of the traffic flows.
The campus LAN connection to the Internet requires the most security. The trust delta is high, but the Internet as a resource is valuable to the campus LAN. Therefore, campus LAN traffic must be able to use resources in the Internet domain. To limit the return traffic from the Internet and lessen the risk of attack, a stateful firewall should be deployed. In addition, NIDS should strongly be considered to check traffic coming from the Internet into the campus.
The connection between the campus LAN and the data center has a much smaller trust delta. In this case, the existing routers could be configured with stateless ACLs to filter the types of traffic coming in to specific servers. The addition of NIDS might not be necessary. Figure 12-12 shows the resulting topology.
Continue reading here: Warning
Was this article helpful?