Webserver on Network, Need support references on how the PA devices can help secure your network

[Net_AdminsRDI]

We have a client that is very concerned about having a webserver on a network that is open to the internet.  They already use exchange and as such ports 80 and 443 are open to that exchange server on the network.  We are hoping to put a webserver on the same network, but are experiencing push back.  The client is of the mind that a webserver must never be placed on an internal network with open ports to the internet.  I am hoping to find some resources on how the use of some of the features that Palo Alto devices provide can help mitigate that risk.   I know that next-gen firewalls such as Palo Alto has cut down on the risk of having a webserver on your network without the use of a DMZ I just need some whitepapers or other trusted resources to back that claim.   

[kadak]

Hello,

You can start configuring policies for your web server to protect from Denial of Server Attacks:

How to protect web-server using DOS policy

Not to forget, that you an apply AV, anti-spyware and vulnerability profiles to the security rule which is responsible for allowing traffic. Plus, you granularize your security rule based on allowed applications only.

Threat Prevention Deployment Tech Note (page 18-28)

Hope that helps!

Thanks and regards,

Kunal Adak

[gafrol]

Put the webserver in a DMZ and use the security profiles to protect it

[pulukas]

Generally, any subnet that has servers hosting internet facing applications should be in a different security zone than the rest of the internal network.  This is the basic definition of the DMZ that has existed from even before the internet when we connected to networks outside our companies.

I don't think web servers are any more vulnerable to compromise from the outside than Exchange.  But I guess hosting a public web site does give more of an advertisement and invitation to visit than spinning up OWA.

So in general, I would suggest creating a DMZ to isolate the public web server and setup the necessary network and security policies from there.  I would encourage moving the Exchange Frontend at least into the DMZ as well.

[dieter_b]

Putting a server in a DMZ doesn't have to mean it's fully open. A DMZ zone is no different to any zone to me, I protect all my zones equally.

Because of the nature of webservers, there will always be a bigger risk, that's why you don't want that (directly) in your internal network...