We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware.

Clients on the untrusted network create reports that need to be read by users on the Corp LAN. Currently the reports are copied from the untrusted network onto a USB scanned by the corp. AV then copied onto the Corp LAN.

We would like to remove the need of the USB transfer and simplify the process.

If we put a firewall at the edge of the untrusted network and a firewall at the edge of the Corp. LAN then in-between the firewalls host a staging server that the files can be stored. We could then open the Corp. LAN firewall to allow users to get to the files.

Is this good practice? What is the risk of malware hoping from one domain to another? Are we opening up our corp. network to any risk?


The networks are physically separate but on the same campus. The Corp network is behind an existing firewall.

enter image description here

  • Have a look into DMZ, that may be of help to you. I would also recommend making sure you have a strict patching policy in place so your firewalls stay up to date
    – Arlix
    Dec 19, 2014 at 14:35
  • Also, make sure you don't get the M&M effect on your network: hard crunchy outside, soft gooey inside :)
    – Ohnana
    Dec 19, 2014 at 14:38

2 Answers 2


You don't necessarily need two separate firewalls to accomplish this.

Without seeing a diagram of your current network topology though, it's difficult to make recommendations.

You mention two separate LANS. Are these logically or physically separated?

You mention copying files onto a USB drive and moving the data to a machine on the other network. That makes me think the two networks share physical proximity. (unless you're mailing the USB drive)

I'm also going to assume that at least one of these networks is already behind a firewall.

The DMZ can be safely hosted from the existing firewall. Two separate firewalls are not necessary to maintain a secure DMZ.

I'd recommend hosting an SFTP server in the DMZ. SFTP typically runs on port 22. The firewall policy would be configured so that the SFTP server cannot initiate traffic to either network.

It may technically be more secure due to recent exploits with USB drives that cannot be fixed. (also see: http://threatpost.com/usbdriveby-device-can-install-backdoor-override-dns-settings-in-seconds/109976)

The (slight) increase in potential attack surface would come from the SFTP server if there was a vulnerability discovered that could allow compromise of the SFTP. However, keep in mind that as mentioned above, the SFTP server would still not be able to initiate communication to the trusted network.


So what you're kind of describing is a DMZ or demilitarized zone. This is a common and widely accepted way for hosting quite a few different services. Such as Web Servers, Mail servers, FTP servers in a safe way.

Essentially for your particular use case and from what you've suggested perhaps using a Dual Firewall architecture DMZ with an FTP server in it, would be the best way to go about this

Dual Firewall DMZ

Because the DMZ acts as a buffer zone between the local area network and the Internet, it is a less secure network than the internal network.

For this reason, there are added security measures that are taken for a DMZ host which include, disabling unnecessary services, running the necessary services with the privileges reduced, eliminating any unnecessary user accounts, and making sure the DMZ has the latest security updates and patches.

The added benefit of the second firewall is that as you know the company from which you're expecting data, you can whitelist them for access to the firewall. Which reduces the risk of an unpatched SFTP server being exploited. Although not fully, as the external company can still be used to launch the exploit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .