Security upgrade recommendations for new webserver 1

[Finchmore]

Hi,

We currently have an NT network with four servers and 50 users and are looking to add an additional web server to host our web site. We have a 1Mb broadband connection through a ZyWall 50 firewall. Does anyone have any helpful advice on whether or not we need to consider adding any additional layers of security to ensure our network doesn't get hacked into? Sorry, internal web stuff is all a bit new to me!

Many thanks.

Finchmore

 

[Castor66]

You can just stick a webserver on your lan and publish that on the internet by mapping an external address to your internal. It's not recommended though.

The ideal would be to have a DeMilitarized Zone (DMZ). This is a third branch off of your firewall (Internal, External and DMZ) which offers less security than your lan would require. You have access from external to the DMZ but not to the Internal. You also have limited or no access from the DMZ to internal. Your web server would sit in there. If it gets hacked then you lose the web server and nothing else. Your lan stays safe.

Your problem is the Zywall - it's only got internal and external interface - no DMZ. Now, for security I would suggest getting a 3 or more interface firewall. There are loads of products out there - it depends on your budget. If your budget is low or non-existent then Smoothwall is your answer. Nice and easy to set up and configure with a huge (and helpful) user community. If your budget is ok then look at getting a low-end netscreen or move up to the ZyWall 100 which has DMZ support.