Solved

Tunneling in DMZ or begind firewall

Posted on 2014-03-31
4
474 Views
Last Modified: 2014-04-01
Is there a good reason to provide tunneling within the DMZ vs. begind the firewall.

In one scenario, you would wrap and unwrap packets within the DMZ (probably from a proxy), and in another scenario you would do it at the application level behind the firewall

Which would be more secure?

njd
0
Comment
Question by:Anthony Lucia
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 39969006
It depends on how you're measuring security. In a sense encapsulating / tunnelling between two end-points is the most secure. That could well be handled at application level. Whether it's actually more secure or not is a matter of trust and how you're tunnelling.  That is:

Do you trust the network (and all services) between two end-points? Are sufficient security controls in place to protect information in transit?
Do you really need to tunnel? This is  where we'd consider encapsulating an entire IP packet.
Is payload encryption (such as SSL) sufficient? Or does does the content of the IP header need to be encrypted as well?

While it's implied in your question, tunnelling does not necessarily mean you're encrypting. Tunnelling on it's own may simply be used as a means to carry one protocol across another.

GRE (Generic Router Encapsulation) tunnelling is a good example of this, it doesn't encrypt the original payload, it simply wraps it up so you can get it from A to B without the path between needing to know about the thing you're attempting to transmit.

A number of technologies are available to both encapsulate and encrypt data in transport. A couple of popular examples include:

IPSEC VPN tunnels - Both L2L (LAN to LAN) and client to LAN.
SSH tunnels  - Uses public / private key cryptography to encrypt everything inside the SSH tunnel.

There are, of course, many other protocols which can be used to tunnel (both with and without encryption). Suitability depends on your goals and the reason for your question in the first place.

Chris
0
 
LVL 64

Expert Comment

by:btan
ID: 39969012
It brings back to principle of detecting at the earliest for any malicious content in the traffic. I was thinking of probably 3 main use case

Case 1 - If we are talking about traditional FW, IP and Port are at most what they can check based on rule so tunneling of the content will make no differences. The traffic such as SSL will pass in and even bypass the IPS or web appl FW unless termination or interception is configured. We should at best do it earliest as another layer before reaching the server end.

Case 2 - If we are talking about NG FW or UTM, content inspection is one area they can inspect further including at application level. Tunneling such as VPN and SSL in common should be terminated or intercepted at this end to inspect before granting the traffic inwards further.

Case 3 - If tunneling is allowed through till the server, it leaves with HIPS in the server to (hopefully) detect the threats incoming, if any. This should be the last line of defence assuming the threat is real, and I do not advocate always relying on that defence and layering is better deterrence scheme instead. Having said that, there is still possibility that (1) and (2) can be somehow bypass/evaded, but we leave it to circumstances such as patch/signature delays, insider, misconfiguration and zero day threats instead of intended tunneling.

Note that the above is assuming inbound traffic we should not ignore outbound too, esp if there is reverse tunneling type or reverse shell type (where the connection is initiated from internal to make it legit and pass the ruleset). Inspection should likewise cater for that. Key is that for all tunneling if there are anomalous tunnel protocol establishment attempts, it should sound the alert aloud (and secure by default, deny that)
0
 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 250 total points
ID: 39969024
Agreed, tunnelling (with encryption) between endpoints tends to act against a defence-in-depth model. The two end-points may (potentially) be the only entities able to consider the actual payload unless you decrypt / re-encrypt somewhere else in the network path.

It's very subjective which is why I start with "it depends" :)

Chris
0
 
LVL 64

Accepted Solution

by:
btan earned 250 total points
ID: 39969062
In the same page. Back to Business call as they are pay owner and their risk appetite. This can be "big" concern if the device or checks are via cloud service host provider - some will not want to "decrypt" for their inspection, but who know they will have already means to "see" what they are supposed not to see :)
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recovering from what the press called "the largest-ever cyber-attack", IT departments worldwide are discussing ways to defend against this in the future. In this process, many people are looking for immediate actions while, instead, they need to tho…
Article by: Justin
In light of the WannaCry ransomware attack that affected millions of Windows machines, you might wonder if your Mac needs protecting. Yes, it does and here is how to do it.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question