6.2Perimeter defense

Perimeter defense is not about "putting up a single wall and being done"—the core of the practice is applying defense in depth, placing multiple defense mechanisms of different natures at the appropriate points. A network specialist must be able to design decisions according to requirements and risk: where to place externally published servers, which layer a firewall should inspect, and how to prepare for attacks specific to web applications.

6.2.1Three firewall approaches

• Packet filtering is the most basic approach, judging whether to pass a packet using only header information such as IP address, port number, and protocol type. It is fast, but has the weakness that it cannot judge whether a response packet is legitimate, since it does not track the context (session state) of the communication.
• Stateful inspection remembers the session state of a communication (such as the progress of a TCP three-way handshake) and judges the legitimacy of response packets based on that context. It can apply dynamic rules such as "allow only return traffic corresponding to an outbound request," making it more secure than plain packet filtering.
• An application gateway (application-level gateway) is a proxy-style firewall that inspects content up to the application layer while relaying communication. It can inspect content down to the HTTP method or URL path, but the processing load is higher and performance is lower than the other approaches.

6.2.2IDS/IPS and WAF

• An IDS (Intrusion Detection System) detects malicious traffic patterns and notifies the administrator (it does not block traffic). An IPS (Intrusion Prevention System) additionally blocks the traffic on the spot. Signature-based detection matches against known attack patterns—high accuracy, but it cannot detect unknown attacks. Anomaly-based detection flags deviation from normal traffic patterns—it can catch unknown attacks, but is prone to false positives.
• WAF (Web Application Firewall) is a dedicated appliance that detects and blocks attacks specific to the web application layer, such as SQL injection and cross-site scripting. Whereas general-purpose firewalls and IPS focus defense mainly at the network-to-transport layers, WAF complements them by inspecting the content of HTTP requests (parameters, etc.).

6.2.3DMZ, proxy, and UTM

• DMZ (demilitarized zone) is a buffer zone belonging to neither the internet nor the internal LAN. Servers published externally (web, mail, DNS, etc.) are placed in the DMZ, and firewalls segment it so that even if a DMZ server is compromised, an attacker cannot directly pivot into the internal LAN—a key piece of defense in depth.
• A proxy (forward proxy) is a server that accesses external websites on behalf of internal clients. A reverse proxy receives requests from outside and responds on behalf of internal servers—it is also used for load balancing, SSL/TLS termination, and hiding internal server addresses. UTM (Unified Threat Management) integrates FW, IDS/IPS, antivirus, URL filtering, and more into a single appliance, suited to reducing operational load at small-to-medium sites.

Suppose a company is redesigning a network that includes the web server and DB server for its e-commerce site, plus internal office endpoints. First, consider "where to place the externally published web server"—placing it directly on the internal LAN would be inappropriate, since if the web server is compromised, an attacker could reach internal office endpoints and confidential data directly. As the designer, you place the web server in the DMZ, segmenting the internet-to-DMZ and DMZ-to-internal-LAN boundaries with separate firewall rules, so that even if the web server is compromised, the path into the internal LAN is blocked. Because the DB server holds customer personal and payment information, you do not place it in the DMZ either, but in a further-protected segment on the internal LAN side, allowing connections only from the DMZ web server on specific ports. Next, because the e-commerce site handles credit card data, you judge that packet-filtering firewalls alone are insufficient against application-layer attacks such as SQL injection, so you add a WAF to inspect HTTP request content. If you also want some resilience against unknown zero-day attacks, you would combine anomaly-based detection alongside signature-based IDS, and if false positives are frequent, start with notification-only IDS operation and gradually move to auto-blocking IPS once operations stabilize—this staged defense-in-depth design judgment is what is required.

6.2.4Section summary

• Packet filtering = header only, stateful = judges via session context, application gateway = inspects up to the application layer
• IDS = detection/notification only, IPS = detection plus blocking, WAF = specialized for web-application-layer attacks
• Place externally published servers in the DMZ and design defense in depth to block a compromise from spreading into the internal LAN