In the last lesson, I introduced the concepts
of zones and I started talking about screened subnets.
In this lesson, I want to dig a little bit further into that,
and then talk about how we can manage them.
So the first thing I had mentioned
was if you have an internet-facing host.
Now, I didn't really go into what that was,
so let me take a step here
and go ahead and define it for you.
When I'm talking about something that's internet-facing,
like an internet-facing host or an internet-facing server,
I'm talking about a host or server that accepts
inbound connections from the internet.
So if I have a web server in my screened subnet,
that is an internet-facing host.
So you can see here, again, if I bring up my diagram,
I have my inside zone, my screened subnet,
and my outside zone.
In that screened subnet, I have two internet-facing hosts,
I have an email server and a web server.
Now, only the email and web servers
that are in the screened subnet are going to be able
to get traffic from the outside,
even though they haven't requested it.
So if you want to connect to my web server,
you're going to go to diontraining.com,
and it's going to go through my screened subnet
into my web server, and then give you back your response.
Now, if you wanted to get to PC2 or PC3
in my inside network, you couldn't do that
because the firewall would block you.
Those are not internet-facing.
They have access to the internet,
but they're not facing the internet,
meaning they are not open and waiting for a connection.
And that's the difference
when you're dealing with internet-facing hosts.
Now, anytime you have internet-facing hosts,
you want to place them into someplace secure,
like your screened subnet.
Now, your screened subnet is actually a segment
that is isolated from the rest of the private network
by one or more firewalls, and it's set up to accept
connections from the internet over designated ports.
Now, the reason we do this is we want to keep
all those forward facing servers
out of our internal network.
We don't want people from the internet
touching our internal network,
we only want them in our screened subnet,
this place that is kind of this semi-trusted zone.
And we know that anything that's behind the screened subnet,
such as my inside zone,
is actually invisible to the outside network.
So if you start scanning my network from the outside,
you're not going to see all those PCs
inside of the inside zone inside.
Instead, you're only going to see the web server
and the email server, 'cause those are forward facing
and they're internet-facing.
Now, the next thing we need to talk about
in terms of the screened subnet is,
what kind of stuff should you put in the screened subnet?
You can see here that I have my email and my web server
in the screened subnet, but any other kind
of communication servers, proxy servers,
or remote access servers
should also be in the screened subnet.
Anything that somebody from the internet
needs access to should be placed in your screened subnet.
This is essentially anything that provides public services,
or even extra net capabilities.
Any of your hosts that are in the screened subnet,
we don't fully trust those, even though they're our devices.
So we want to make sure that we harden them as best as we can.
And we have to remember that those devices,
because they're forward facing,
they could be touched by an attacker,
they could be compromised by an attacker.
So that's why they're not fully trusted
to our internal network.
And that's why we actually have it go through the firewall,
anything that's going from the screened subnet
to the inside, and from the inside
back to the screened subnet.
That's another good place
to put intrusion detection systems, to make sure
that you're catching anything that may be going
from your screened subnet, because a common technique
for an attacker is to compromise something
in the screened subnet and then use that
to pivot into your network.
So you want to protect yourself against that.
Now, any kind of host you put in the screened subnet
should really be what we consider a bastion host.
This is a host or server
that we put into the screened subnet,
which is not configured with any services
that run on the local network.
So I don't want to run something like active directory
inside the screened subnet,
that's an internal network service.
Instead, I only want to run things
that should be in the internet.
Things like email, things like web,
things like remote access, those things can be hardened
and put into the screened subnet, because we know
that they're going to be more vulnerable to attack.
Now, when we want to configure our devices
inside the screened subnet, what are we going to do?
Well, we're going to use something known as a jumpbox.
Now, a jumpbox is a hardened server that provides access
to other hosts within the screened subnet.
So essentially, we have this one server,
and it is what can talk to the screened subnet.
And we configure all the access control to make sure
that only the jumpbox can communicate
from the internal network to the screened subnet.
Now, because of that, that jumpbox
has to be heavily hardened, it needs to be protected.
And what ends up happening is the administrator will connect
to the jumpbox and then the jumpbox will connect
to the host and the screened subnet.
Then I call a jump box,
'cause we're almost pivoting off of it.
We're going to connect from me to the jumpbox,
and the jumpbox to the server I want to configure,
and that's why we call it a jumpbox.
Now, this jumpbox can be a physical PC
or it can be a virtual machine, either one is fine.
A lot of people use virtual machines as a jumpbox
because you can have it hardened and secured.
You can use it for the time you need,
and then destroy it and rebuild a new one,
because it's very quick to rebuild an image
from a virtual machine if you already have
a known good image.
And so, a lot of people will do it that way.
Now, the jumpbox and the management workstation
that you're using to connect to that jumpbox
should have only the minimum required software
to perform their job, and they should be well hardened.
Again, this is the one box that has the permissions
to go through the firewall and touch the screened subnet
from your internal network.
So you want to make sure it is well protected.
This is why you want to make sure that management workstation
and the jumpbox are fully hardened,
and they have the least amount of software on them
to make sure they're fully hardened and fully secured.