Front cover - IBM Redbooks

4.4 Summary
The updated data is then replicated to the Domino content server (circle 11).
Again, we check our data being accessed to see if we are meeting our security
policies:
1. The administrator uses strong authentication (Notes ID and password) to
access the staging server; however, our Intranet to Data Access policy does
not require this flow to be encrypted. The Domino replication between the
staging server and the content server meets our Data Access to Data Access
policy because the data is not confidential.
Although this may appear to be a somewhat complex example, in fact it has been
greatly simplified. In practice, servers are usually duplicated for redundancy.
Also, we did not show in all cases how an administrator in the Intranet can
access each server in the different zones. One way this is done is by using yet a
fifth type of zone just for administrative access, an “Admin Zone.” And we did not
attempt to depict every possible network connection. In most cases, hosts in the
Proxy zones and Data Access zones are dual-homed, meaning they do, in fact,
have separate network connections to the upper and lower zone boundary
routers and firewalls. Remember, even though they might have physical network
connections, we block all traffic at each boundary by default, except what is
explicitly required and permitted by our policy tables.
In this chapter, we have discussed several topics that comprise security
architecture:
► Infrastructure components
► Using multiple network zones
► Data flow and data access policies
► Analysis of data flows to ensure policy fulfillment
We presented a multi-zone architecture model that is based on four types of
network zones:
1. Internet zone
2. Proxy zone
3. Data access zone
4. Intranet zone
These zones were described in terms of what types of data we recommend
locating in each, as well as the data access requirements. We also presented a
Chapter 4. Security components and layers 163