Front cover - IBM Redbooks

– The resource does not permit communications or access to (or through)
the resource by any external entity (that is, routing to an Intranet zone
system).
– The resource may store and process classified information in accordance
with the organization’s security standards.
– Access to resources on a Data Access zone must require strong
authentication of any entity requiring access to the resource or data
storage.
4. Intranet zone
This is the internal IP network. All internally reachable servers and workstations
are in this zone. Characteristics of resources in the Intranet zone are:
– The resource’s IP address is within the internal IP address ranges
assigned to the organization and the resource’s Domain Name is only
contained in the internal domain reserved for internal use only.
– The resource is protected from foreign networks and systems by a
managed secure perimeter.
– The resource is under the physical control of the organization. Physical
control requires the resource to be located at an organization facility, a
facility operated by a subsidiary, or a facility operated by a trusted
outsourced operation provider.
– The resource must be administered and operated by organization
employees, subsidiary employees, or the organization’s approved I/T
provider.
– The resource must be in compliance with applicable organizational
security policies.
– The resource does not permit communications or access to (or through)
the resource by any non-organization entity unless designated as an
infrastructure component (for example, routing to an external entity).
Note that we have four types of zones, not necessarily just four actual zones. For
example, we could have multiple Proxy zones in order to separate different
externally reachable services. We might include a special, dedicated Proxy zone
just for administrative access. We can also have multiple intranet zones to isolate
critical business systems such as financial systems and HR systems. In this
model, we have a key assumption that all servers in zone types 2 through 4 must
be in controlled premises and managed by trusted personnel.
Now that we have defined the four types of zones, our model appears to be
relatively simple, but it is far from complete. We next need to describe the
controls we will use to connect and or isolate systems in different zones.
Chapter 4. Security components and layers 141