0

In a scenario where you have a Wireless network provisioned as untrusted behind a firewall, using VPNs to reach the trusted Datacenter. Does anyone have an reason why this should/not be expanded to include the wired edge ports - essentially bringing the firewall around the datacenter and making the LAN untrusted. It would save deploying 802.1x and allow network sharing with other partners.

2
  • A little more info on what infrastructure you have would be useful. Do you not need any layer of security between WLAN and LAN?
    – Owen
    Nov 14, 2013 at 10:43
  • After a certain building size you can't assume that the client LAN is any more trusted than an open WLAN. Always consider the scenario of someone entering your building and plugging an unauthorized notebook into some unattended network port.
    – Philipp
    Nov 14, 2013 at 13:10

2 Answers 2

2

It all depends on your security model, but as Google recently found out, even if you own the link between your servers, you still can't assume that it's secure.

The idea of hardening the edge of your network with appropriate protection and then playing "anything goes" with the internals is a popular tactic, but one which has significant, disastrous security implications. Once your perimiter is breached, you have no protection. And company after company has discovered that a perimiter breach is not as impossible as your network planning diagram would suggest.

Ideally, you should have host-to-host encryption and security, with each node an individually-secured island. Doing this correctly can range anywhere from "expensive and complicated" to "crazy-expensive and mind-blowingly-complicated", but if you design your system right, you should be able to safely expose your entire internal network to the public Internet. Of course, you would never actually do that, but you should be able to. That's defense in depth.

0

Why not? Because you might want to have control over the LAN as a separate concern than the Datacenter. Otherwise, as I do not know what you have on the LAN and what classification those assets are, any LAN could be classified as 'public'.

It's all about classifying your assets and placing the appropriate protections to those assets. 'Classification' is the underlying issue to your original question. If you don't care about the WIFI or LAN, then reduce protections in those areas and let it be a free-for-all. No need for authentication, traffic validation, etc. Once you start to care, though, make sure you care enough.

Classify the assets, the users, and the data. Rule-of-thumb: Weakest classification (e.g. 'public') persists even to those items that they connect to. Design separation of items from that perspective.

So, if all you are classifying is the Datacenter, as a result you are automatically classifying the rest as 'public'. If that fits your situation, that's fine. If not, then you have to employ some more design.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .