Home > Design Patterns > Secure On-Premise Internet Access

Secure On-Premise Internet Access (Cope, Erl, Kristan)

How can a network segment with Internet access be secured?

Secure On-Premise Internet Access

Problem

The security profile for a network segment that has Internet access is equivalent to that of the Internet, which makes assets, internal or cloud, vulnerable to attacks over this segment.

Solution

A system can be established whereby an Internet access segment consisting of network elements that support outbound interactions from the site to external entities via the Internet and all inbound interactions are handled via a controlled sharing (DMZ) segment. This DMZ segment contains mitigations to the current attacks and connection to cloud resources is established from a separate trusted network segment using cryptography.

Application

Using firewall and router security mechanisms, subnets with access controls lay the foundation for separating and protecting resources and at the same time provide required Internet access.
Secure On-Premise Internet Access: An example of subnet segmentation, firewalls and NAT provider protection from Internet intruders.

An example of subnet segmentation, firewalls and NAT provider protection from Internet intruders.

Secure On-Premise Internet Access: An example of the application of the Secure Internet Access pattern.

An example of the application of the Secure Internet Access pattern.