NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
offers the most benefits with the least amount of risk for most organizations. The DMZ allows access to
the resources located within it to both internal and external users. There are a wide variety of DMZ
configurations, each with its own strengths and weaknesses.
Creating a DMZ involves placing a firewall between an organization’s border router and its internal
network, and creating a new network segment that can only be reached through the DMZ device. The
Web server is placed on the new segment, along with other network infrastructure components and
servers that need to be externally accessible. In some configurations, the border router itself may act as a
basic firewall. Figure 8-1 illustrates an example of this simple DMZ using a router with access control
lists (ACL) to restrict certain types of network traffic to and from the DMZ.
Figure 8-1. Simple Single-Firewall DMZ
A single-firewall DMZ is a low-cost approach because the organization needs only to add a single
firewall and use its existing border router to provide protection to the DMZ. It is usually appropriate only
for small organizations that face a minimal threat. The basic weakness in the approach is that although
the router is able to protect against most network attacks, it is not “aware” of the Web server application
layer protocols (e.g., HTTP) and thus cannot protect against application layer attacks aimed at the Web
server. A superior approach is to add a second firewall between the Internet and the DMZ, as shown in
Figure 8-2.
Figure 8-2. Two-Firewall DMZ
8-2