What is DMZ Network?
DMZ or Demilitarized Zone Network or Perimeter network or a Screened subnetwork represents a network firewall between an internal and external network. DMZ is the boundary between an organization’s secured internal network and the Internet. Usually, it is a network device or a software component within your network’s main router to the Internet. DMZ Firewall is designed to block and allow traffic based on a set of rules that have been loaded into its configuration.
In any company, it is common to offer different services accessible from the Internet, either for employees or clients, such as a web page, email, or simply a file server. These services can be outsourced to a company specialized in the cloud or dealt with internally from the organization using its own resources. The main advantage of dealing with it internally will be to hold control of your own information without exposing it to third parties, which will result in preserving privacy. Another advantage is that the server can be custom-designed according to the company’s needs compared to more generic cloud servers.
When access is allowed from the Internet to a web page, mail server, file server, virtual private network, etc., the risk of suffering a security incident increases. If a cybercriminal manages to breach the security of one of these servers, it could compromise the rest of the devices connected to the network, even those that are not accessible from the Internet. Unwanted access could lead to a ransomware infection, spied communications, stolen files, service outages, etc.
A demilitarized zone is an isolated network within the organization’s internal network. All the company’s resources that must be accessible from the Internet, such as the web or mail server, are exclusively located there.
In general, a DMZ allows connections from both the Internet and the local network of the company where the workers’ computers are, but connections from the DMZ to the local network are not allowed. This is because servers accessible from the Internet are more susceptible to an attack that could compromise their security. If a cybercriminal compromised a server in the demilitarized zone, it would be much more difficult for him to access the organization’s local network since the connections from the DMZ are blocked.
DMZ network design with VLAN
DMZ network design with VLAN example consists of firewall router using VLAN’s on the interface, which is connected to switch. On the switch, VLANs are created to segregate between the web server and LAN network.
Where should network management systems generally be placed?
Network management systems generally should be placed out of the band. Out-of-band management allows the network operator to establish trust boundaries in accessing the management function to apply it to network resources.
DMZ Design
There are different approaches to plan an organization with a DMZ. The two essential strategies are to utilize possibly a couple of firewalls; however, most present-day DMZs are scheduled with two firewalls. This fundamental methodology can be developed to make more mind-boggling designs.
The safer way to deal with making a DMZ network is a double firewall setup, where two firewalls are conveyed with the DMZ network situated between them. The primary firewall – additionally called the border firewall – is designed to permit outer traffic bound to the DMZ, as it were. The second, or interior, firewall allows traffic from the DMZ to the inward organization. This is safer because two gadgets should be undermined before an assailant can get to the interior LAN.
Security controls can be tuned explicitly for each organization’s portion. For instance, an organization interruption discovery and counteraction framework situated in a DMZ could be arranged to impede all traffic aside from HTTPS solicitations to TCP port 443.
Many routers provided by Internet providers have in their configuration an option to enable a DMZ through which a company computer is made accessible from the Internet. Activating this option is not highly recommended since we would make the network protection depend exclusively on the router. And it must be taken into account that a router is not a device that has been specifically designed to fulfill the functions of a firewall, its security characteristics being much more reduced.
In addition, since the DMZ is more prone to attack, it is advisable to use other types of monitoring, detection, and prevention tools. For this, intrusion detection and prevention systems or IDS and IPS will be used. Finally, it will be a critical task to keep the systems in the DMZ up-to-date to the latest version available.
Publishing any service on the Internet from the network to the company will always increase the risk of suffering a security incident. To reduce risks and protect internal company information and devices, a demilitarized zone can be created. If you will publish a server on the Internet in your company, place it in a DMZ.
DMZs are planned to work as such a cushion zone between the public web and the private organization. Conveying the DMZ between two firewalls implies that all inbound organization parcels are screened utilizing a firewall or other security apparatus before showing up at the association’s workers in the DMZ.
I suppose a more ready danger entertainer goes through the primary firewall. In that case, they should then acquire unapproved admittance to those administrations before they can do any harm. Those frameworks will probably be solidified against such assaults.
At last, accepting that a well-resourced danger entertainer can penetrate the outside firewall and assume control over a framework facilitated in the DMZ, they should, in any case, get through the inward firewall before they can arrive at touchy undertaking assets. While a decided aggressor can penetrate even the best-got DMZ design, a DMZ enduring an onslaught should set off cautions, giving security experts enough admonition to deflect a full break of their association.
DMZ Application
DMZ networks have been a significant piece of big business network security for nearly as long as firewalls have been being used and, in a considerable part, are sent for comparative reasons: to ensure delicate hierarchical frameworks and assets. DMZ organizations can disengage and keep potential objective frameworks separate from interior organizations, just as lessen and control admittance to those frameworks outside the association. Utilizing a DMZ has for some time been the methodology for facilitating corporate assets to make probably some of them accessible to approved outside clients.
All the more, as of late, endeavors have picked to utilize virtual machines (VMs) or holders to seclude portions of the organization or explicit applications from the remainder of the professional workplace. Cloud innovations have significantly eliminated the requirement for some associations to have in-house web workers. Large numbers of the outside confronting foundation once situated in the undertaking DMZ have moved to the cloud, like programming as-an assistance (SaaS) applications.
