Suppose you have an app on the DMZ servers. The app needs to access the internal services installed in the internal network. The internal firewall between the DMZ and internal network has rules to allow traffic only from specific source (DMZ server) to specific ports (for the specific services).

Do you also block any requests from internal network as well? For example, have a white list of allowed internal IPs to call those services and others will be blocked from the insider threat perspective. That white list will probably be blank for PROD because for PROD, there is absolutely no reason other system (other than DMZ server) to access those services.

Is this the general practice in the wild? Any better suggestion?


Any app in the DMZ is at best only semi-trusted. Ideally apps in the DMZ should have NO reach into the internal network, data should be pushed not pulled so firewalls only need to open from the more secure to the less secure network not the other way around.

If that is not possible for some reason (and it would have to be a really good reason!), you need to make absolutely certain that the DMZ app has the minimum possible access to anything.

In addition, you don't really even want anything reaching out if you can avoid it. Every connection is a potential risk.

In most cases, you would even create a parallel network for management traffic so that you can further limit and reduce the available attack windows.

Blocking Insider Threats

Restricting internal networks to block insider threats is a sensible idea but don't loose sight of the value of your data and the relative risks involved. Most forms of security come with some cost maybe $$$ but maybe in admin overheads and user overheads so be sensible.

Having said that, it is very important to separate assets of differing values and security. So high security data such as your core PKI infrastructure or patient records, etc. should be kept separate from less important data such as management information perhaps (depends on your business). Segmenting data in this way can actually reduce costs in some cases because, even though the infrastructure and admin costs may be higher, the physical protection costs overall may be less than having to protect everything.

There isn't really a one-size-fits-all solution for this.

One other consideration. Internal controls are by no means just about stopping insider threats. Remember that most intrusions to large enterprise data lie undiscovered for 12m or more and often are only discovered by external parties. It is common practice for the bad guys to break into something innocuous and then slowly work their way up the food chain, keeping below the intrusion detection radar all the way.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.