What is more risky? Database Server in DMZ or Trusted Network?

Question

Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.

Assume the following

• A web server is being used for intranet and internet purposes
• The above system requires active directory synchronization, but is not necessarily compatible with AD LDS
• The aforementioned web application thus needs to perform lookups from the AD database for integration with Active Directory.

Now, I'm quite sure the following topology would be ideal (noting each | represents a firewall). Correct me if I'm wrong, but this topology prevents the DMZ from ever interacting with the Trusted Network, and keeps the database out of the DMZ.

INTERNET <-> | <-> DMZ <-> | <-> Database Zone <-> | Trusted Network

Now assuming what I've said above is true, what if a company didn't have the capacity for a 3 firewall approach? Would the bigger risk be putting the Database Server in the DMZ, or would it be keeping it in the trusted network with specific firewall rules allowing access to the trusted network?

Answer 1

The usual scenario used by large banks is to site the database servers in the internal network, although generally segregated using access controls on the routers serving that segment. Logically this follows your proposed description.

Best way to think of it is as follows: the database probably has some of the most important information assets of your company. Do you really want it in the DMZ? A network segment that is known high risk.

Answer 2

One solution: put the database server in your trusted network, make sure you only allow database ports through.

Maybe a better one would be to:

1. Turn on the OS firewall on the db server and lock it right down

2. Give it a DMZ NIC and a Trusted Net NIC

3. Make sure your database security is locked down and everything is blocked in and out except the traffic you want (i.e. allow AD traffic on the trusted NIC and not on the DMZ, etc.)

That would give you, logically, the topology you described, but it will increase the risk if your database server is compromised.

Is it worth keeping the database server off the domain? That'll mean you should be able to have only the SQL ports open.

Maybe set up a pair of named instances? One for external one for internal - then you can logically separate everything.