2

I have a large document store of client data on my internal network. I am in the process of engaging some developers to build a website to make this data available to my clients externally. I also want my clients to be able to upload new documents that will get put into the same file store.

I have created a front end DMZ for my website, a back end DMZ for my website DB, and I have my internal network where my files are stored. Each layer is separated by firewalls.

How should I securely deliver the files to the FE website?

  • Should I create a web service on the FE web server that can access the internal network for the files?
  • Should I create a web service on a server in the BE DMZ that can access the internal network for the files?
  • Should I create a web service on the internal network that can grab and deliver the files, and enable the FE website to talk to that web service on a set port?

Any other way I should be doing it?

I am looking for the most secure method, as the client data is very sensitive to my business

Improve this question

1 Answer 1

Reset to default
1

You for sure do not want to expose the FE webserver to access the internal network. If someone pops your FE box, then they'll have access to your internal network. I would also not give your BE DMZ access to the internal network directly. I would install an SSH server on your BE DMZ that is only available to your internal network and then I would transfer the files from the internal network to the BE DMZ over SSH. You'll also want to protect the data in a secure area on your BE DMZ system using encryption at rest as well as TLS for over the wire.

Improve this answer
1
  • So, create an SSH server on the BE DMZ, and create a service on the internal network that can talk to that SSH server to put the files for the FE website to pick them up from and present them to the user? Making sure to lock down access to the SSH server by IP and encrypt the traffic with TLS?
    – mwiggs
    Sep 14, 2015 at 10:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .