Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks.

For example should the network atleast have the following firewall zones?

  • Client network
  • DMZ
  • Customer facing network (internett)

Is it considered best practice to keep and maintain firewalls inside the zones (on each individual server) aswell as on the zones itself?

I would appriciate any tips regarding best practice designs of firewalls.

share|improve this question
1  
I think it would really depend on what those firewalls are supposed to be protecting. Could you describe the environment in which these firewalls would be used? What level of assurances are necessary, etc. –  Steve Nov 1 '11 at 22:38

2 Answers 2

up vote 3 down vote accepted

'Best' is probably not the right word here, as the specifics vary with needs, however 'standard' industry practice for enterprise level financial services organisations (a good benchmark) includes:

Client network, with segregated access-controlled subnets for specific key assets (usually customer databases, HR data, financial data)

  • FIREWALL

Multiple DMZ's - usually split either by function or risk profile (eg a DMZ for transactional services, one for remote access for staff, and another for 3rd party connections)

  • FIREWALL

Internet, remote clients etc

Firewalls should be from different vendors eg Juniper, Cisco, Checkpoint etc. to increase the time an attacker would take to get past them both (would require two exploits)

share|improve this answer
    
What logic would you use to determine which Firewall vendors segregate which networks? –  Steve Nov 2 '11 at 2:41
1  
In practice it doesn't seem to matter, however if pressed I would suggest using the one with the highest throughput rate as the external one, as it will have to deal with more traffic. –  Rory Alsop Nov 2 '11 at 8:50

should the network at least have the following firewall zones?

Not necessarily.

It's a fairly common model though.

I'd recommend (in addition to all the usual security measures)

  • implementing the OS firewall on all machines as well as using dedicated firewall devices where appropriate
  • implementing proper egress filtering on the OS as well as on the network devices

Also, getting your routing set up correctly is an essential part of network security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.