Internal network segmentation using firewalls

[ggarlington]

Recently an external auditor suggested we should segment the internal network including all enterprise applications, desktop population, internal e-mail, remote access, and the wan using firewalls. Is anyone doing this? If so why?

[turnbull · Accepted solution]

The concept of the demilitarized zone (DMZ) provides protection for higher level servers and applications etc whilst permitting web and mail servers typically, access to and from the Internet. If these host become compromised, they do not provide an immediate stepping stone to the important internal servers.

Risk assessment of the company's resource will determine the level of access control neccessary. The highest instances of compromise are still determined to be from internal sources and may warrant access control measures applied to the desktop population depending on the company's circumstances and the security posture adopted.

Cheers,

Paul.

[ggarlington]

Can you give a specific example where a company (other than those dealing with finance, public safety or national security) has implemented firewalling of all network segments?

[dink]

Hmmm, I would say the WAN would certianly need to be Firewalled, but segmenting the internal network with firewalls is just going to slow down the internal operations. If i understand the question correctly, a better solution might be to segment different portions of the network with VLANS. Depending on your core switches, you could vlan each segment and use intervlan routing to control who goes where and keep all the traffic in each segment from mingling together.