Page 452 - StudyBook.pdf

436 Chapter 7 • Topologies and IDS

■ DNS Services A DNS server might be placed in the DMZ in order to
point incoming access requests to the appropriate server with the DMZ.
This can alternatively be provided by the Internet Service Provider (ISP),
usually for a nominal extra service charge. If DNS servers are placed in the
DMZ, it is important to be careful and ensure that they cannot be made
to conduct a zone transfer (a complete transfer of all DNS zone informa-
tion from one server to another) to any server.This is a common security
hole found in many publicly accessible DNS servers.Attackers typically
look for this vulnerability by scanning to see if port TCP 53 is open.
■ Intrusion Detection The placement of an IDS system (discussed later in
this chapter) in the DMZ is difficult and depends on the network require-
ments. IDSes placed in the DMZ will tend to give more false positive
results than those inside the private internal network, due to the nature of
Internet traffic and the large number of script kiddies out there. Still,
placing an IDS on the DMZ can give administrators early warning of
attacks taking place on their network resources.

The rise of e-commerce and the increased demand of online transactions has
increased the need for secure architectures and well-designed DMZ’s. E-commerce
requires more attention to be paid to securing transaction information that flows
between consumers and the sites they use, as well as between e-commerce busi-
nesses themselves. Customer names, addresses, order information, and especially
financial data need greater care and handling to prevent unauthorized access.This
greater care is accomplished through the creation of the specialized segments men-
tioned earlier (which are similar to the DMZ) called security zones. Other items
such as the use of encryption and the use of secure protocols like secure sockets
layer (SSL) and transport layer security (TLS), are also important when designing a
more secure architecture.

Multiple Needs Equals Multiple Zones

Security requirements for storing customer information and financial data are dif-
ferent from the requirements for storing routine, less sensitive information that
businesses handle. Because this data requires processing and much of the processing
is done over the Internet, more complicated network structures must be created.
Many organizations choose to implement a multiple segment structure to better
manage and secure their different types of business information.

www.syngress.com