How might I increase the security and scalability of my DMZ?page up: Firewalls FAQnext page: 33 How can I block all of the bad stuff?
An architecture whose security hinges upon one mechanism has a single point of failure. Software that runs bastion hosts has bugs. Applications have bugs. Software that controls routers has bugs. It makes sense to use all of these components to build a securely designed network, and to use them in redundant ways. If your firewall architecture is a screened subnet, you have two packet filtering routers and a bastion host. (See question 3.2 from this section.) Your Internet access router will not permit traffic from the Internet to get all the way into your private network. However, if you don’t enforce that rule with any other mechanisms on the bastion host and/or choke router, only one component of your architecture needs to fail or be compromised in order to get inside. On the other hand, if you have a redundant rule on the bastion host, and again on the choke router, an attacker will need to defeat three mechanisms. Further, if the bastion host or the choke router needs to invoke its
Related Questions
- How might I increase the security and scalability of my DMZ?page up: Firewalls FAQnext page: 33 How can I block all of the bad stuff?
- How do I make DNS work with a firewall?page up: Firewalls FAQnext page: 46 How do I make Telnet work through my firewall?
- What can a firewall protect against?page up: Firewalls FAQnext page: 12 What about viruses?
