0

I know that access should be restricted from DMZ hosts to non-DMZ hosts where possible (i.e., my web servers should only be able to talk to other internal resources where necessary). But is it best practice to also restrict traffic in the other direction?

For example:

  • Is it ok to allow developers to connect to the corporate VPN and then directly RDP into the DMZ web servers?
  • Is it ok to allow all other servers to access the DMZ web servers without firewall restrictions, just as they would be able to access any non-DMZ server?
Improve this question

3 Answers 3

Reset to default
2

Security zones are usually categorized by their security level (=their need for protection).

The basic rule about inter-zone communication is that you often permit higher-security hosts access to lower-security hosts, but not the other way around.

Your DMZ hosts are accessible from the Internet - at least in part. Unless there's a very good reason to restrict access to them from your LAN(?) hosts, you likely wouldn't want to do that.

However, the details depend on your overall security policy. Generally restricting any access unless it's actually necessary is usually a very good idea.

In a very strict scenario, you wouldn't allow your developers administrative access anywhere outside the development zone. Web server code should get updated by your administrators instead, after passing full testing.

Improve this answer
1
  • 'exposed to the Internet' is vague and 'it depends' is vague, and "if you're really serious you wouldn't allow your developers admin access" is incoherent.
    – Ronnie Royston
    Jun 7, 2022 at 2:15
1

There is no one answer to your question. Whether it's "OK" depends on your risk tolerance, your relative vulnerability, and the sensitivity of your assets. Only you can answer that question.

Improve this answer
5
  • he's specifically asking about best practices. maybe point to best practices according to x vs best practice according to y. It's a best practices question that seems legit to me.
    – Ronnie Royston
    Jun 7, 2022 at 2:17
  • 1
    @RonnieRoyston I find that there never is a consensus on what “best” practices are. You might be able to define “good enough” practices given a specific set of circumstances, but they don’t apply generally. Your answer is a good example: Google’s requirements are very different than your average corporate network, and their “best practices” are more aspirational than operational.
    – Ron Trunk
    Jun 7, 2022 at 12:59
  • the concept of best practices is accepted across industries, from accounting to engineering to medicine. Internet Protocol is Internet Protocol no matter what company utilizes it.
    – Ronnie Royston
    Jun 7, 2022 at 18:16
  • As a concept, I agree with you. But the more you try to make the practices apply in more situations, the more superficial they become. You end up saying things like "it's a best practice to block unauthorized access." True, but not particularly helpful.
    – Ron Trunk
    Jun 7, 2022 at 18:56
  • Best practices are a thing. Any assertion to the contrary is wrong.
    – Ronnie Royston
    Jun 7, 2022 at 21:37
-1

Best practice according to Google is that there is no trusted zone, or network. There is no DMZ. None. No network is trusted, or partially trusted.

What is BeyondCorp?

BeyondCorp is Google's implementation of the zero trust model. It builds upon a decade of experience at Google, combined with ideas and best practices from the community. By shifting access controls from the network perimeter to individual users, BeyondCorp enables secure work from virtually any location without the need for a traditional VPN.

Improve this answer
11
  • 1
    That's not a Google invention, it's called the Zero Trust security model. In practice, Zero Trust mainly augments security zoning and can't fully replace it, because most services aren't sufficiently hardened.
    – Zac67 ♦
    Jun 6, 2022 at 18:26
  • Best practice according to Google is not synonymous to Google invented the zero trust model and it most certainly does mean that that there are no security zones.
    – Ronnie Royston
    Jun 7, 2022 at 2:12
  • 1
    Zero trust is a noble goal that is impractical given the current available technology. I don't think you can label something a "best practice" when it can't actually be practiced.
    – Ron Trunk
    Jun 7, 2022 at 13:44
  • 1
    Oh, yes. As we're attempting to implement the strategy at my current client, we have yet to find products that actually implement the strategy in a coherent way. No one protects headless devices. Few can protect against lateral movement. It might be better called "low but non-zero trust." If you're interested in specifics, we can discuss in chat.
    – Ron Trunk
    Jun 7, 2022 at 19:00
  • 1
    Let us continue this discussion in chat.
    – Ron Trunk
    Jun 8, 2022 at 16:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.