Avatar of sunhux
sunhux
 asked on

outgoing licensing validation should be in DMZ or internal/backend zone? What mitigations if none

We have a internal zone server holding financial data.

Users would like to load ACL (Audit Command Language) into it to analyse the data but ACL
requires periodic (think can be daily) connection to Internet (& possibly incoming ports but
I'm not certain about incoming) for license validation.

Q1:
For a server that goes out to Internet, shouldn't it be placed in DMZ rather than internal zone?

Q2:
Or it does not matter for outgoing;  it's more for incoming connections (eg: web server) that
needs to be placed in DMZ?

Q3:
If we don't move the server to DMZ, what are the mitigations we can consider?
Let this server connect to a proxy to go out to Internet?
Use firewall to permit it to a specific destination IP for license validation only?
If the ACL component can't go by proxy, but it requires a non Tcp80/non Tcp443,
is this considered safe to permit (without going thru proxy)?

Q4:
If an internal zone server (Prod) goes out via proxy on Tcp80/443, isn't this
akin to a sysadmin being allowed to browse Internet from an internal server
which is risky?
Network SecurityNetwork OperationsSecurity

Avatar of undefined
Last Comment
Aaron Tomosky

8/22/2022 - Mon
Aaron Tomosky

A dmz is just an old word for a firewalled vlan, so if you want a firewall in between your financial server and a server that talks to the internet, then yes, do that. Something like VMware NSX offers microsegmentation, basically giving every single VM a firewall. This is the future.
sunhux

ASKER
Thanks Aaron.
We are not opting for VM as that dept has no budget for it.
So you agree that such a license server should be seated in DMZ ?
So if it sits in internal zone going thru proxy to do license validation, it's not recommended (ie a risk)?
ASKER CERTIFIED SOLUTION
Aaron Tomosky

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes