Protecting data within the intranet from internet

Question

i want to build an internet facing website that interact with internal resource such as referential data.

We have a DMZ zone and intranet zone. When users logs in to the website, the http web server in dmz makes a connection with the intranet zone via a messaging service , the business logic application server in the intranet zone responds to the request.

However we have an internal team raising concern that the connection between DMZ and intranet is risky, instead they suggested that we do it this way. Place an request service in DMZ, when user logs in, the service puts a request row in this service store, in the intranet zone, create a poling service that monitor any request being placed in the DmZ, if found, pushes only information related to the login user to the Dmz via a file rsync from intranet. In this way , no direct connection is allowed to initiated directly from external, and safer. However, as file copy is slow, this will hit performance on the webpage, imaging client logs in and wait for file to be generated , encrypted and copied, then decrypted, read and presented ! That addes so much complexity to front end server to read files instead of JMS service call.

What do you think of the proposed solution? and is there alternative than file copy but not compromising the security?

Answer 1

Your question is not well explained. I think you want to replace a messaging service (is this a message queue, and http connection, or something else?) with a database table in the DMZ that's polled by the server in the private subnet, to service a real time web request. When there's a reply it's rsync'd back to the web server.

That will likely result in a large increase time required to service a request. Even polling the database every second will result in latency, and rsync and polling a file system is going to introduce more latency and complexity. This is not practical, it's complex, and it's unnecessary.

A message queue might be more practical, but again they're not really meant for real time communications. You'll have to have your web server sit polling a queue to wait for a reply, taking resources.

A better model is likely to be ensure you have:

• A properly configured firewall at the entry point to the DMZ and the private subnet/intranet
• A layer that checks requests on the way in, such as a WAF. This can be a piece of hardware or a service. CDN vendors offer a WAF service (AWS WAF, CloudFlare, and Incapsula are some I know of). You can also use mod_security with the OWASP rule set, but it's tricky to tune.
• IDS/IPS systems in place
• Monitoring so you know what "normal" is for your network
• Ensure your internal application has been properly code reviewed and security checked, for example to combat common attacks like SQL Injection. Coverage of the OWASP top ten is a minimum.

Answer 2

I tend to agree with the concerns raised by your internal team.

However, why use rsync? The important thing is that an intranet host, rather than a DMZ host, initiates the connection, eg that there is no way to initiate a connection DMZ -> Intranet, but you can just as well put a database or any other service in your dmz and poll and update it from the intranet.