Solved

Safest way to publish web services?

Posted on 2011-09-28
3
565 Views
Last Modified: 2012-08-13
Hi,

Please can you give your opinion on the safest way to host internal web services?

We have 2 options…

1st option is that we simply place the web server in to a DMZ off the corporate firewall – Cisco ASA 5500. We would just allow connections to come in to the web server in the DMZ on ports 80 and 443, there is a static NAT rule on ASA to facilitate this. The web server would not be a member of the corporate domain, and would have no connectivity through the firewall to the inside network.

2nd option is that we locate the web server on the inside network. In addition, we host a unihomed Microsoft ISA 2006 server in the DMZ. We instead allow the port 80 and 443 connections to come in to the ISA server in the DMZ, then we allow the ISA server to access the web server on the inside network through the ASA firewall on ports 80 and 443. The ISA server will be acting as a reverse web proxy server and would not be a domain member.

Please can you somebody advise which option is more secure. and maybe provide pros and cons for each. would either setup work well, or is 1 option more secure than the other.

appreciate your feedback, and will respond quickly to any questions.

thanks,

L-Plate
0
Comment
Question by:L-Plate
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 10

Accepted Solution

by:
ienaxxx earned 500 total points
ID: 36716297
Hi,
the second option is the more secure, since it also check for viruses in uploaded files and has APPLICATION FILTERING, that is: check that the commands passing here are really HTTP commands.

Top security would be achieved using a TMG 2010 , that has rules that identify exploit traffic, updated really often. So, if you are using IIS and, for example, they discover a 0 day vuln, you'll be protected even in the meantime before the necessary patches.

Additionally, i can suggest you to host both ISA/TMG AND the public webserver on the DMZ.


Moreover, i suggest you to study on ISA / TMG documentation to deploy your customized protection rules set.

HTH, Bye!
0
 

Author Comment

by:L-Plate
ID: 36716416
thanks ienaxxx for your quick reply.

it was my feeling that the 2nd option was best based on the layer 7 inspection. of course we only get layer 3 and 4 inspection on standard firewall.

to be honest, the 2nd option is the way that we currently have this configured in our network, but we DO have the public web server on the inside network. is this ok how it is, or do you strongly advise against this. Just FYI, we only allow the ISA server to talk to the web server on the inside network on ports 80 and 443. is this safe or should we move it in to the DMZ?
0
 

Author Closing Comment

by:L-Plate
ID: 36890688
Thanks for your help!
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
A phishing scam that claims a recipient’s credit card details have been “suspended” is the latest trend in spoof emails.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question