1

I am working a project which requires access to a service running on a remote server, over a single TCP port (>1024). This service runs on a machine located within an existing network, and the project I'm working on is located on a new (web) server, external to this network.

It was agreed up front that for this project to work the port must be opened up to the new server, however the IT team have now decided the security risk is too great to 'open up' their internal network.

They justified this to me by saying if the new server is compromised it could allow an attacker into the internal network. But would this not be mitigated by only allowing access on a single port, to a single machine in the network? This would be done through a firewall/NAT system outside of either server's control.

I understand that the internal service then becomes the attack vector but I would argue that it's designed to be public facing anyway, so at this point their justification falls down.

I am not a security expert by any means, so what could the problems be here that I am missing? (and they are not explaining)

Improve this question
9
  • What's wrong by using firewall to separate the network and put stuff into the DMZ ? In addition, for web services, one can always deploy it to the cloud/hosting services.
    – mootmoot
    Jul 24, 2018 at 16:06
  • The normal way of handling this is to use a VPN that allows accessing internal resources. Why wouldn't you do that?
    – Steve Sether
    Jul 24, 2018 at 17:19
  • @mootmoot I believe the service is hosted internally for performance reasons, arguably that approach is outdated, but that doesn't change the reality.
    – James
    Jul 24, 2018 at 17:50
  • @SteveSether I'm not able or inclined to do anything, I just have to deal with the IT team that needs to do things. VPN is something I'd considered, but if the service is compromised wouldn't that still allow access to the internal network? The service is used internally, so it couldn't be wholly on a virtual network.
    – James
    Jul 24, 2018 at 17:53
  • @James The VPN being compromised is far less likely than the service you're currently developing being compromised. VPNs are designed to be secure, your application sounds like it's still being worked on. If I put on my security hat, I'd be much more trusting of a mature product from a security company than a product in active development being developed by likely non-security aware developers. Security isn't black and white, it's all shades of grey.
    – Steve Sether
    Jul 24, 2018 at 18:00

1 Answer 1

Reset to default
3

You are essentially asking to allow access from outside to some internal system, i.e. a system which is in the same internal network with other machines where access to these machines should not be allowed from the outside.

If an attacker manages to break out of your application due to some security issue it means that the attacker can now access and attack all the other machines in the local network. Because of this it is quite understandable that IT team does not want to allow this kind of access.

But would this not be mitigated by only allowing access on a single port, to a single machine in the network?

Access to this specific port is enough to break out of your application if the application is insecure. It does not protect against attacking the rest of the internal network from the compromised machine.

... but I would argue that it's designed to be public facing anyway, so at this point their justification falls down.

Public facing services should be put into a separate network zone (DMZ) where they are reachable from the outside but have no access to the internal network. This way the impact of a compromise is reduced to this separate zone but cannot affect the internal network.

Improve this answer
2
  • Just to clarify, the internal service is not my application - I agree, I wouldn't want my application hosted on the internal network, it's a website and will always pose a threat. The service however is a mature software application licensed from a third-party - of course it could have vulnerabilities, so could anything. How would a DMZ work where the internal network needs access to the same service? Sounds like this is something they should be proposing (but I'm having to figure out...)
    – James
    Jul 24, 2018 at 17:59
  • 1
    @James: if the application needs access to some specific internal services it is best to still isolate the application into the DMZ and ideally let the internal service from the internal network connect to the application in the DMZ instead of allowing connections from the DMZ into the internal network. Of course this must fit into the design of the application which is unknown - so I can give only generalized advice.
    – Steffen Ullrich
    Jul 24, 2018 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .