"DMZ" that can be roughly understood in 5 minutes, easy explanation of roles and construction methods | Business + IT

Solving business issues by integrating IT and management

What is Business + IT?

Login

E-mail newsletter registration

What is Business + IT?

Sales Strategy

Cost reduction

Organizational reform

Production / manufacturing

crisis management

compliance

Energy saving and environmental friendliness

By industry / scale

Core system

Information system

Operation management

Security

network

mobile

hardware

development

Related genres

"DMZ" that can be roughly understood in 5 minutes, gently explains the role and construction method

In the world of network security, a special network area called "DMZ" may be created. This acts as a "buffer area" to protect important information and terminals connected to the network. How can a DMZ be built, what features it has, and how it will be used. I will explain the basic mechanism of the DMZ gently.

Freelance writer Naoki Mitsumura

Freelance writer Naoki Mitsumura

Representative of GK Noteip. Writer. He majored in computer science at a university in the United States, and after graduating, engaged in planning and marketing of IT-related products at some listed companies in Japan. After retiring, he has been involved in writing books and articles and creating web content as a writer. In addition to artificial intelligence, he deals with topics related to science, IT, military, and medical care, and also conducts research support activities at research institutes and universities. His books include "Core Technology in the Near Future (Shoeisha)", "Illustration: An Introduction to AI Business (Narumi-do)", and "Artificial Intelligence in Manga (Ikeda Bookstore)".

1. Buffer zone on the network, "DMZ"
2. The mechanism of DMZ, the key is "firewall"
3. Various ways to build a DMZ
4. Balance safety and convenience

Buffer zone on the network, "DMZ"

DMZ is an abbreviation of "DeMilitarized Zone" and is translated directly as "demilitarized zone" in Japanese. Originally diverted from military and political terms, it means "unarmed territory," as the name implies, "a territory that does not allow military activities." It points. What both network and military terms DMZ have in common is that they act as a "buffer zone" between "dangerous areas" and "safe areas." It's dangerous to keep important things right next to a dangerous area, so set up a buffer zone so that you don't have to put anything important in it if something goes wrong. .. In the world of computer networks, "dangerous areas" are "external networks" such as the Internet where security cannot be confirmed. There are malicious attackers on the Internet, and Web servers and mail servers that are open on the Internet can be attacked at any time. If a server that is open to the outside is placed in the same location as the internal network that contains confidential information, there is a risk that the internal network will also be invaded when the server is attacked. Therefore, an isolated area called DMZ is provided to separate the area accessed from the external network from the internal network. As a more familiar example, "a space such as a garden from the entrance door to the gate of a house" or "the entrance hall of an apartment with a shared entrance" may be closer to the sensation. Although it is on our premises, it is a place where both outsiders and insiders can easily enter. Moreover, since there are not many important things placed, there is little damage even if a thief enters, and it is also a place where you can be alert if there is a suspicious person. The DMZ has the same role as these spaces. The buffer zone allows you to isolate important things in a safe place and easily interact with people from outside.

The mechanism of DMZ, the key is "firewall"

So how do you specifically build a DMZ? The key is in the "firewall". In a computer network, a firewall acts as a boundary, such as a "barrier" or "border" that separates the inside and outside. "People" are sorted at barriers and borders, but firewalls separate "necessary communications" and "unnecessary communications" so that only necessary communications can pass through. This firewall plays an important role in the DMZ. Create a structure that puts a firewall between the external network and the DMZ, and the DMZ and the internal network, and sort the communication. Since the sorting policy can be freely set for each firewall, even if the firewall between the external network and the DMZ is loosely set, it will be more secure if the firewall between the DMZ and the internal network is set strictly. The important thing is the internal network, so it is our policy to absolutely protect this. If you compare it to a castle during the Warring States period, the security of the castle town where the townspeople and peasants enter and exit is not so strict, but the security of the castle gate directly connected to the residence of the daimyo is strict. The firewall is installed even if the DMZ is not installed, but the firewall installed between the Web server and the external network is widely open. Therefore, it is less vigilant and vulnerable to external attacks. If the web server is located on the internal network, the hijacked web server can be used as a stepping stone to easily attack the internal network. Creating a DMZ does not change the vulnerability of the Web server itself. However, when entering the internal network from the DMZ, you need to go through the firewall again. If you block access to the internal network from the DMZ, you can protect the internal network even if the web server is hijacked. The firewall acts as a "double barrier". In addition to firewalls, DMZs often provide multiple security within the DMZ by combining "IDS (Intrusion Detection System)" that reports unauthorized access and "IPS (Intrusion Prevention System)" that blocks access. is. Since the DMZ is a space created on the assumption that it will be attacked, it is also necessary to create a mechanism to notice that it has been attacked. In addition, it is ideal that the DMZ is physically isolated via a router, etc., but if it is difficult, it can be built in a virtual space built on a computer. The virtual DMZ itself is in the internal network, but the virtual DMZ can be accessed from the outside. Virtual DMZs are often used for individuals and homes rather than for business purposes, so you can think of them as simple DMZs. [Next page] Consider the various construction methods of the DMZ and the balance between safety and convenience.

Recommended articles

Firewall / IDS / IPS (Intrusion ... Genre Topics

To List

Firewall / IDS / IPS (Intrusion ... Genre IT introduction support information

To List

PR

SB Creative Co., Ltd.

Business + IT is operated by SB Creative Corp. of SoftBank Group.

By registering as a business + IT member, you can subscribe to member-only content and e-mail newsletters, and invite you to special seminars!