Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
3

we intend to build a network in a small health center with No Internet Access

it is expected to have 30 terminal machines, all machines will use an electronic medical record web application

we want to "hide" the application behind firewall

share|improve this question
Hi Mokokamello - can you give some more information, for example what is the structure for, where is it (is it a family network with blog on the webserver, or a small office network with webserver, or something in between?) – Rory Alsop♦ Dec 21 '10 at 0:03
@Rory Alsop check my edit – Mohamed Kamal Dec 21 '10 at 0:09
Will update accordingly. – Rory Alsop♦ Dec 21 '10 at 0:13

2 Answers

up vote 15 down vote accepted

Updated to take into account the zero Internet Access:

As you have mentioned, the switch can be configured to route the ISA server to segregate the application from the users. It looks from your model you are expecting the ISA to run a public and private VLAN through its connection to the switch.

More typically having a dual homed firewall is considered more secure, as traffic on each network is physically separated by the firewall. But basically the app server will connect to the ISA on a network port for the 'protected' side, and a network port on the 'user' side of the ISA will connect to the switch.

You can obviously use access control lists in the switch to provide further controls, however this may be all you need in terms of infrastructure.

alt text

One risk to look at is how likely a PC is to be attacked in your environment. Are they left unattended? And unlocked? Your infrastructure may then not be sufficient.

edited to say - if medical/personal data is on the server, and you are in a country with strong regulations in this area you may need to use stronger controls.

share|improve this answer
4  
@Mokokamello - Logically you can make your setup work, but the risk is higher. ie you can use your switch to route traffic from users to ISA, ISA to App server and back, it just has a lower degree of segregation. Generally I would try to describe the options to the data owner and get them to make the call on what risk they can accept. Depending on your local laws, personal/medical data on the server may require a higher degree of protection (eg DPA in the UK, HIPAA in USA) – Rory Alsop♦ Dec 21 '10 at 0:32
up vote 4 down vote

Two thoughts:

  1. Can the terminal machines communicate with each other? There might be a risk of one terminal monitoring communication of another one. There are two user accounts so there must be segregated data. The switch helps mitigate this but it can be defeated.

  2. How hard is it to hook a little pocket wifi router into the ethernet cable connected to the back of the terminals? That would give someone remote access to spend time attacking.

share|improve this answer
agreed - physical access to the machines (and Cisco switch even if it is not physically secured) on the network can not be underestimated since they are likely your highest IT security risk with a 100% internal network – August Jan 8 '11 at 0:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.