Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

126 CHAPTER 8 Security Standards and Services
DMZ
Mail
Server
Web
Server
FIGURE 8.1
A multiple interface
firewall DMZ
implementation
Internet
(External Network)
Firewall
Internal Network
■
File Transfer Protocol (FTP) services FTP file servers provide public and
private downloading and uploading of files.
EXAM WARNING
Remember that FTP has significant security issues in which username and password
information is passed in clear text and can easily be sniffed.
■
■
■
E-mail relaying E-mail relaying is a special e-mail server that acts as a
middleman by accepting messages and passing them through to their destination.
E-mail relays are typically disabled on all publicly accessible e-mail
servers.
Domain name system (DNS) services A DNS server might be placed in the
DMZ to point incoming access requests to the appropriate server within the
DMZ. It is important to be careful and ensure that DNS servers in the DMZ
cannot be made to conduct a zone transfer to any server.
Intrusion detection IDSes placed in the DMZ will tend to give more false
positive results than those inside the private internal network, due to the
nature of Internet traffic. To reduce the larger number of false positives, you
must perform IDS tuning, which is the process of adjusting the settings on
your IDS so that it is more appropriately configured to recognize normal
traffic patterns in your environment.
Many organizations choose to implement a multiple segment structure to better
manage and secure their different types of business information. The two
segments that are widely accepted are as follows: