Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

Security Zones 125
SECURITY ZONES
You must imagine the different pieces that make up a network as discrete
network segments, called security zones, each holding systems that share common
requirements. Characteristics of security zones include the following:
■
■
■
■
Systems in a zone may be running different protocols and OSes, such as
Windows and NetWare.
The type of a computer and its operating system do not dictate a particular
security zone.
Where the machine resides in the environment helps to define the security
zone it resides in.
Common requirements of a security zone may include the following:
■ The types of information the zone handles.
■ Who uses the zone.
■ What levels of security the zone requires to protect its data.
EXAM WARNING
A security zone is defined as any portion of a network that has specific security concerns or
requirements. Intranets, extranets, demilitarized zones (DMZs), and VLANs are all security
zones.
The following are samples of security zones that may be defined in your
environment:
■ DMZs A DMZ is a network segment which exists between the hostile Internet
and the trusted internal network. Often, systems which need to be made
accessible to the public Internet are placed in the DMZ, which offers some
basic levels of protection against attacks but is not considered as secure as
the trusted internal network.
■ DMZ segments can exist in one of the following two ways:
• Layered DMZ implementation – the systems that require protection
are placed between two firewall devices with different rule sets, which
allow systems on the Internet to connect to the offered services on the
DMZ systems, but prevent them from connecting to the computers on
the internal segments of the organization’s network.
• Multiple interface firewall implementation – a third interface is added
to the firewall and the systems that require protection are placed on
that network segment. The same firewall is used to manage the traffic
between the Internet, the DMZ, and the protected network. See
Figure 8.1 for a diagram of a multiple interface firewall implementation.
The role of the firewall in all these scenarios is to manage the traffic between
the network segments. The systems in the DMZ can host any or all the following
services:
■
Hypertext Transfer Protocol (HTTP) servers Internet Information Services
(IIS) or Apache servers provide Web sites for public and private usage.