Secure On-Premise Internet Access (Cope, Erl, Kristan)
How can a network segment with Internet access be secured?
ProblemThe security profile for a network segment that has Internet access is equivalent to that of the Internet, which makes assets, internal or cloud, vulnerable to attacks over this segment.
SolutionA system can be established whereby an Internet access segment consisting of network elements that support outbound interactions from the site to external entities via the Internet and all inbound interactions are handled via a controlled sharing (DMZ) segment. This DMZ segment contains mitigations to the current attacks and connection to cloud resources is established from a separate trusted network segment using cryptography.
ApplicationUsing firewall and router security mechanisms, subnets with access controls lay the foundation for separating and protecting resources and at the same time provide required Internet access.
MechanismsApplication Delivery Controller, Domain Name Service, Intrusion Detection and Prevention Systems, Security Information and Event Management System, Virtual Private Network
Compound PatternsBurst In, Burst Out to Private Cloud, Burst Out to Public Cloud, Cloud Authentication, Elastic Environment, Infrastructure-as-a-Service (IaaS), Isolated Trust Boundary, Multitenant Environment, Platform-as-a-Service (PaaS), Private Cloud, Public Cloud, Resilient Environment, Resource Workload Management, Secure Burst Out to Private Cloud/Public Cloud, Software-as-a-Service (SaaS)
An example of subnet segmentation, firewalls and NAT provider protection from Internet intruders.
An example of the application of the Secure Internet Access pattern.