Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 264
  • Last Modified:

dmz servics question

Hi.
Situation: LAN will inter-connet to another network. The other network has both company and non-company staff, but they all use computers that I don't administer or own.
My company staff (on the interconnecting network) need to access applications (currently web based using AD authentication) on my domain.
I will put in place a DMZ between my lan and "wan" link, but i am trying to think of the best way to allow access direct to the apps on my lan for company staff.
Something tells me allowing HTTP traffic just to flow through the firewalls isnt the best case scenario. I could place terminal servers within the DMZ but would prefer not to from a user experience and file transfer viewpoint. I can't put any VPN software on thier machines as I dont own them.
Any ideas?
0
58872
Asked:
58872
  • 2
2 Solutions
 
bhnmiCommented:
SSLVPN?
0
 
rjmedinaCommented:
There are many solutions that would address your situation.  The question is what kind of resources do you have available and how quickly is your company expecting a solution?

First thought was that you'd want to serve the applications to the untrusted folks through a web server in the DMZ.  Where the web server reaches back into the the trusted network as a relay between the untrusted and the trusted staff.  This however takes time and possibly some programming depending on the applications to be provided.

Second thought, if your primary concern is whether or not the machines of the non-company staff are not patched, don't have virus scan etc. then to mitigate this you could implement a NAC (Network Access Control) solution.  With a NAC solution the machines are put into quarentine first, scanned to make sure they have the latest patches, updates etc. before allowing them access to the internal network and applications.

Third, you work out an agreement with the non-company management to adhere to certain standards.  If they have a real need to use your company's applications then their management will probably agree to implement some solution to protect themselves as much as you and your companies interests as well.

Fourth, a VPN solution would work, but typically VPN solutions are built on the premise that you trust the person VPNing into the network, so if you don't trust them other security measures would still need to be taken to limit what they can access.

Hope this helps...
0
 
58872Author Commented:
Thanks for advice...going down SSL VPN route.
0
 
bhnmiCommented:
I love my Sonicwall SSL-2000 It also has a remote assist option that allows me to remote controll any machine as long as it has an internet connection. Like the Bomgar Box or goto assist.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now