Defining the security perimeter

[adriatikb]

We have to define the security perimeter for our company but we don?t know were to start it. Can anyone tell me what are the main topics and things that we have to evaluate for that. Any resource that help us about how to make this kind of decisions?

Thanks in advance

[rtrunk]

Boy, that's such a broad question that it's hard to give you a useful answer.

But in general, your security perimeter is the dividing line between the systems you trust and the ones you don't. In a simple network, the perimeter is your Internet firewall. That separates the Internet from your trusted systems on your LAN. But it can get much more complicated very quickly. Add in Web servers, VPNs, extranets and wireless, and your perimeter becomes harder to define.

The more information you give on this forum, the better the answer you will get.

Ron

[michaelwoolfe]

I have also heard people describe the internal network as the network that you control and the external network as the area where you have foreign users and vendors. As stated above, this can quickly become very complicated with outsourced services and new technology like application-as-a-service.

It might help to know more about the audience. You can also note (and make yourself sound very smart) by telling them that the "internal" and "external" networks is becoming harder to determine especially when it comes to threats. This is why IPS/IDS/NAC technologies are going to become mainstream tools.