Front cover - IBM Redbooks

4.2.3 Zone boundaries
142 Lotus Security Handbook
Security zones should be separated with zone boundaries. Before we can identify
the specific boundary functions needed, we describe the general objectives and
principles of a zone boundary. The functions of the zone boundary are to:
► Protect the organization’s data and resources from tampering, misuse, and
theft
► Provide logical and physical separation of server and network resources in
the environment
► Deny all traffic, by default, except that which is specifically required to
facilitate application enablement for business needs
► Reduce exposure of information that indicates the structure of the
architecture itself, including the hiding or obfuscation of back-end server
resources and networks
► Log boundary ingress and egress activity and attempt to identify suspicious
data traffic patterns where possible
Zone boundaries, from a network design point of view, consist of firewalls. Recall
the literal definition of a firewall as a physical barrier to prevent the spread of fire?
We will apply this metaphor to using network firewalls to block or limit an
intruder’s ability to “spread” influence across zones. Also recall that there are
several different types of firewalls. We will define firewalls placed throughout the
architecture in terms of what functions are needed at that particular boundary.
For example, a router that has IP filtering enabled is technically a firewall, at least
in the strictest sense of the definition. Granted, this is a very low-level type of
firewall. But perhaps we need both IP filtering and application-level proxy
functions. To build this type of firewall, we might need two devices back-to-back.
The point is, we cannot simply draw a firewall as a cute cartoon of a brick wall
and provide any real meaning in our network diagrams. We have to indicate the
functions that are performed at the boundary, then the physical manifestation will
be dictated by the functions and the products available that provide the functions
and performance we require. As you document your environment with diagrams,
be prepared to explode any logical firewalls and clouds into the underlying
detailed network and components. Just keep in mind that a zone boundary can
begin to appear as a zone itself when the number of defenses employed grows.
The zone boundaries can become quite non-trivial.
One of the principles stated previously is that by default we should deny all traffic
except that which is necessary. This is considered a “best practice” in IT security,
but it is often a challenge to enforce. The challenge comes from being able to
accurately identify all addresses, ports, and protocols in advance, then configure
the various filters to allow just the things identified. In addition, some protocols