What is the best practice for placing DataBase servers in secure network topologies

Question

I have a classic DMZ architecture:

My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network as it contains confidential data.

Where should I place the DB server and why? Should I add a second firewall and create another DMZ?

Answer 1

• The best placement is to put the database servers in a trusted zone of their own.
• They should allow inbound connections from the web servers only, and that should be enforced at a firewall and on the machines. Reality usually dictates a few more machines (db admin, etc). Obey reality as needed, of course.
• They should only be making outbound connections if you're updating software on them.

Answer 2

Agree with Jeff Ferland, database servers should be on their own: you should have a clean network for replication & backup.

Pardon my ASCII art, a quick overview of a reasonable ideal:

      [internet]
          |
    outer-firewall--- [proxy-zone]
          |      
         ----- [app-zone]
          |
    inner-firewall 
[lan]--/         \-- [database-zone]

1. Run a reverse-proxy, Apache+mod_security/varnish/nginx/WAF/whatever, in the proxy zone. Add load-balancing/failover here if needed too. Also proxy/relay server for outbound connections (DNS, SMTP, HTTP proxy), if required.
2. When application logic runs on a web server (Java/PHP/ASP), I prefer to call it an application server.
3. When you need to scale you can scale horizontally, load balancers make this easier. You may also consider replicating static unauthenticated content to the front-end proxies.
4. you might want to add one or more of zones: IDS, management, backup, remote access, outbound proxy

You're trying mitigate, so:

• inter-zone communication must be limited to the minimum required for service and monitoring purposes.
• reverse-proxy accepts untrusted connections from the internet, can only connect to services on application servers. If you want to classify your zones by traffic you need to consider carefully termination of HTTPs, and if you want to create new HTTPs connections to the app servers.
• application zone accepts semi-trusted connections from proxies, can connect only to databases. You can trust your application servers a little bit more when you know they're not talking directly to the internet.
• database servers accepts connections only from application servers, the database zone should be your "cleanest" network
• consider using different firewalls (vendor/product) for the outer- and inner-firewalls
• for required outbound services (DNS, SMTP or patching/updates) these should go via a distinct server (e.g. on the proxy-zone, or outbound-proxy-zone).
• same goes any outbound CC validation HTTPS connections. (If you're unlucky enough to have some vendor-provided black box for validation, that ought go on a dedicated zone too, IMHO.)
• use public IP addressing only in the proxy zone, private addressing elsewhere. No server outside proxy zone need have a public IP, NAT, or a default route to the internet.

Separate zones makes your IDS's job easier, and logging more effective. If you have the resources, add a management-zone, separate management NICs for each server (protected ports if you can).

In reality you may end up compacting the "ideal network" to a single firewall and VLANs, but if you consider your options now with the above in mind it should be easier to migrate in future, i.e. shortly after the next visit from your friendly neighborhood PCI-DSS auditor ;-)

Answer 3

The following is quite a common setup for DMZ architecutre:

Internet

^

Firewall1

^

DMZ (Host your dmz servers here only allowing specific ports through the firewall)

^

Firewall2

^

Database Network (only allow specific ports and protocol from firewall2 to this network)

As you mention the database contains credit card (sensitive) data then even on the innerside of firewall2 the database network should be segregated from the corporate and user networks. So many times I see the crown jewels of a company wide open on the internal network for all users to probe and access. Going a step further you could have a database admin VLAN only only allow systems within this VLAN permission to access the databases (apart from the application that needs to access it from the DMZ of course).

Hope this helps.

Answer 4

As you will need to comply with PCI-DSS you will also need to ensure that you have firewalls at each internet connection and between DMZ and internal networks. Theres some good pointers in the self asssessment questionnaires.

Also dont make the database server if a wintel box a member of the domain etc

Answer 5

3-Tier Architecture is the most secure and scalable solution. As client traffic is increased we can add up as many middle tiers needed to ensure performance. Three Tier architecture is also more secure because the middle layer is protecting the database tier. We need to protect database tier from direct access and need to be placed it in trusted zone and it should be only accept connections from application servers.